Skip to content

Remove the release workflow that could never publish #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oscarvalenzuelab merged 1 commit into from
Jul 24, 2026
Merged

Remove the release workflow that could never publish #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 0 additions & 46 deletions .github/workflows/release.yml
View file
Open in desktop

This file was deleted.

26 changes: 26 additions & 0 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,32 @@ pytest --cov=src2purl
pytest tests/test_specific.py
```

## Releasing

Publishing to PyPI runs from `.github/workflows/python-publish.yml`, which triggers when a
GitHub release is published and authenticates with PyPI trusted publishing through the `pypi`
environment.

```bash
# 1. Bump the version in pyproject.toml and src2id/__init__.py, add a CHANGELOG entry, merge it
# 2. Tag the release commit
git tag -a vX.Y.Z -m "Release X.Y.Z"
git push origin vX.Y.Z

# 3. Publish the release, which starts the PyPI upload
gh release create vX.Y.Z --title "X.Y.Z" --generate-notes
```

Release notes are generated by GitHub from the merged pull requests, so they do not need to be
written by hand.

Step 3 has to be a real user action. A release created by a workflow using `GITHUB_TOKEN` does
not raise the `release: published` event, so the publish workflow would never start.

Confirm the upload with the version-specific endpoint, `https://pypi.org/pypi/src2purl/X.Y.Z/json`.
The aggregate `https://pypi.org/pypi/src2purl/json` is cached and can lag a few minutes behind,
which looks like a failed upload when it is not.

## Community

You can chat with the community on:
Expand Down