From 6fadb04bfb0104cb1d78fbd41938cddeb0e7b902 Mon Sep 17 00:00:00 2001 From: Manfred Riem Date: Wed, 10 Jun 2026 08:42:34 -0500 Subject: [PATCH] fix: address PR review feedback on publish workflow - Add actions: read permission (required for artifact upload/download) - Move version check after uv install and use uv run python (ensures Python >=3.11 with tomllib is available regardless of runner image) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/publish-pypi.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index e5d8ac28f..2b4e6f942 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -10,6 +10,7 @@ on: permissions: contents: read + actions: read jobs: build: @@ -28,19 +29,19 @@ jobs: exit 1 fi + - name: Install uv + uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5 + - name: Verify tag matches package version run: | TAG_VERSION="${{ inputs.tag }}" TAG_VERSION="${TAG_VERSION#v}" - PROJECT_VERSION="$(python3 -c 'import tomllib; print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')" + PROJECT_VERSION="$(uv run python -c 'import tomllib; print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')" if [[ "$TAG_VERSION" != "$PROJECT_VERSION" ]]; then echo "Error: Tag version ($TAG_VERSION) does not match pyproject.toml version ($PROJECT_VERSION)" exit 1 fi - - name: Install uv - uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5 - - name: Build package run: uv build @@ -56,6 +57,7 @@ jobs: environment: pypi permissions: id-token: write + actions: read steps: - name: Download build artifacts uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4