From 845e27fc3235f503a5fb173a3414711aae08390b Mon Sep 17 00:00:00 2001 From: JeffreyChen Date: Thu, 23 Jul 2026 15:19:18 +0800 Subject: [PATCH] Put releases back on merges to main MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Restores the guard 7ddac38 replaced with `if: false`, so merging to main bumps the patch version, uploads to PyPI with the existing PYPI_API_TOKEN secret, and pushes the bump commit plus its tag. The guard matters: the same workflow also fires on pull requests and a nightly schedule, and an unguarded job would cut a release from both. release.yml keeps building, smoke-testing and attesting every v* tag — only its upload is switched off, so the tag stable.yml pushes cannot start a second upload of a version PyPI already has. Going back to tag-driven releases means registering a PyPI trusted publisher for release.yml and swapping the two conditions. --- .github/workflows/release.yml | 8 ++++++++ .github/workflows/stable.yml | 8 ++++++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 43d182c6..f02adcee 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,6 +56,14 @@ jobs: publish: needs: build + # Publishing happens on merge to main (stable.yml), so this path stays + # off: the tags stable.yml pushes would otherwise start a second upload + # of a version PyPI already has. The build job above still runs on every + # v* tag — it verifies the tag matches pyproject, smoke-tests the wheel + # and attests provenance. To go back to tag-driven releases, register a + # PyPI trusted publisher for release.yml, drop this condition, and put + # stable.yml's publish job back behind `if: ${{ false }}`. + if: ${{ false }} runs-on: ubuntu-latest environment: name: pypi diff --git a/.github/workflows/stable.yml b/.github/workflows/stable.yml index 06e6e1e1..02b068cd 100644 --- a/.github/workflows/stable.yml +++ b/.github/workflows/stable.yml @@ -118,8 +118,12 @@ jobs: publish: needs: test - # Publishing moved to release.yml: immutable v* tags + Trusted Publishing. - if: ${{ false }} + # Releases ride on merges to main: this job bumps the patch version, + # uploads to PyPI with the PYPI_API_TOKEN secret, then pushes the bump + # commit (marked [skip ci]) and its v* tag. The guard is what keeps it + # off pull requests and the nightly schedule, which the same workflow + # also triggers on — without it every PR would cut a release. + if: github.event_name == 'push' && github.ref == 'refs/heads/main' runs-on: ubuntu-latest permissions: contents: write