From 1efe6346a76154ec28e6210827bf2cdf2ce428ef Mon Sep 17 00:00:00 2001 From: Manfred Riem Date: Thu, 11 Jun 2026 12:50:58 -0500 Subject: [PATCH] fix: address third review round - Use job-level permissions: actions:write on build (for upload-artifact), actions:read on publish (for download-artifact) - Include both @latest and pinned version in release notes - Add note that PyPI may lag behind the GitHub release Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/publish-pypi.yml | 3 ++- .github/workflows/release.yml | 10 +++++++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index 91ef3ef0a..6cedde684 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -10,11 +10,12 @@ on: permissions: contents: read - actions: read jobs: build: runs-on: ubuntu-latest + permissions: + actions: write steps: - name: Checkout release tag uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e4af57e0f..a22c7c34b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -66,16 +66,24 @@ jobs: ## Install \`\`\`bash - uv tool install specify-cli==${VERSION_NO_V} + uv tool install specify-cli@latest specify init my-project \`\`\` + Or pin to this exact release: + + \`\`\`bash + uv tool install specify-cli==${VERSION_NO_V} + \`\`\` + Or install from source: \`\`\`bash uv tool install specify-cli --from git+https://github.com/github/spec-kit.git@${VERSION} \`\`\` + > **Note:** PyPI publishing runs shortly after this release is created. If the PyPI version is not yet available, use the source install command above. + NOTES_EOF echo "## What's Changed" >> release_notes.md