Repository navigation
feat(release): lock project selections and guard uploads - #14
Merged
Merged
Conversation
Marketplace can accept an upload before the workflow records its result. Check prior attempts and signed artifacts before retrying; require manual reconciliation when acceptance is uncertain.
Use the released full-lock exporter for PR checks and weekly refreshes while keeping privileged installs on selected cooled groups. Check frozen hook revisions and their complete cooled dependency closure before PR merge and tagged release execution. Preserve secondary Nab build matrices.
gaborbernat
added
bug
A repository with no managed hook pins needs one reviewed PR to add the complete cooled closure. Keep subsequent human changes to managed pins blocked. Set author identity in scratch Git repositories so cutoff tests run on hosted runners.
A human could move a managed pin to another hook while preserving the global pin count. Compare pins by repository and hook identity, and reject duplicate identities when managed pins exist.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Use released
release-creator locksto refresh and check the full selectablepylock.toml: runtime dependencies, every group and extra, build requirements, and supported platform and Python markers. Pull request checks reproduce the committed lock, while privileged jobs install only their selected, cooled release groups. Secondary build matrix locks continue to use Nab.Check every changed hook configuration from bots and people for immutable revisions, revision age, and its complete cooled Python dependency closure. This migration adds the first managed pins while the base has none; later human edits to managed pins remain blocked, and the complete closure check applies in both cases. Release preparation checks the frozen closure again, and shared
preksteps enforce the seven-day cutoff and PyPI source settings when hooks install.Before uploading a signed ZIP, the JetBrains Marketplace Action checks prior tag runs and release deployments. A matching acceptance receipt also verifies the earlier signed ZIP and notes bytes. Callers need
deployments: readand areleaseenvironment. An earlier deployment without a verified receipt stops the rerun for manual reconciliation; the README gives the steps for inspecting an upload and clearing a proven stale deployment. This also covers runs whose Actions history has expired, though a contributor-only earlier deployment can require manual review.