Uh oh!
There was an error while loading. Please reload this page.
DEVOPS-1154: address warnings upon publishing Python packages from GitHub - #166
Open
RomFloreani wants to merge 5 commits into
Open
DEVOPS-1154: address warnings upon publishing Python packages from GitHub#166RomFloreani wants to merge 5 commits into
RomFloreani wants to merge 5 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Updates GitHub Actions workflows to address warnings when publishing Python packages from GitHub, shifting PyPI/TestPyPI publishing to OIDC trusted publishing (run in-repo) and aligning workflow calls to updated CI-tools implementations.
Changes:
- Switch PyPI/TestPyPI publishing to an in-workflow job that uses a composite action for OIDC trusted publishing.
- Remove reliance on
PYPI_TOKEN/TEST_PYPI_TOKENsecrets for publishing. - Update multiple reusable workflow
uses:references to CI-toolsDEVOPS-1154.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/security_scan.yml | Updates CI-tools reusable workflow refs for Zizmor scanning jobs. |
| .github/workflows/python_deploy_prod.yml | Adds a dedicated in-repo PyPI publish job (OIDC) and updates CI-tools workflow refs. |
| .github/workflows/python_deploy_dev.yml | Adds a dedicated in-repo TestPyPI publish job (OIDC) and updates CI-tools workflow refs. |
| .github/workflows/pr_jira_actions.yml | Updates CI-tools reusable workflow ref for PR→Jira automation. |
| .github/workflows/issue_to_jira.yml | Updates CI-tools reusable workflow ref for issue→Jira automation. |
Suppressed comments (5)
.github/workflows/security_scan.yml:45
- Using a moving branch ref (
@DEVOPS-1154) for a reusable workflow makes the CI supply chain mutable (the branch can be force-pushed/deleted) and can break reproducibility/auditing. Prefer pinning to an immutable commit SHA (or a released tag once available).
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@DEVOPS-1154
.github/workflows/python_deploy_prod.yml:44
- Using a moving branch ref (
@DEVOPS-1154) for a reusable workflow makes the CI supply chain mutable (the branch can be force-pushed/deleted) and can break reproducibility/auditing. Prefer pinning to an immutable commit SHA (or a released tag once available).
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@DEVOPS-1154
.github/workflows/python_deploy_prod.yml:69
- Using a moving branch ref (
@DEVOPS-1154) for the composite action makes the publish step mutable and harder to audit. Prefer pinning to an immutable commit SHA (or a released tag once the CI-tools changes are released).
uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_pypi@DEVOPS-1154
.github/workflows/python_deploy_dev.yml:32
- Using a moving branch ref (
@DEVOPS-1154) for a reusable workflow makes the CI supply chain mutable (the branch can be force-pushed/deleted) and can break reproducibility/auditing. Prefer pinning to an immutable commit SHA (or a released tag once available).
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@DEVOPS-1154
.github/workflows/python_deploy_dev.yml:59
- Using a moving branch ref (
@DEVOPS-1154) for the composite action makes the publish step mutable and harder to audit. Prefer pinning to an immutable commit SHA (or a released tag once the CI-tools changes are released).
uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_pypi@DEVOPS-1154
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
sebhmg
reviewed
Aug 24, 2026
| with: | ||
| source: artifact | ||
| artifact-name: mira-simpeg-pip-package-build | ||
| # Intentionally a direct step here, not nested in a reusable workflow or |
There was a problem hiding this comment.
ok, good enough to have the job inlined here, as the job is kept small enough thanks to the reusable action
sebhmg
requested changes
Aug 24, 2026
sebhmg
left a comment
There was a problem hiding this comment.
use shorter comment to explain about not using reusable worklfow for pypi publish
Comment on lines
+58
to
+64
| # Intentionally a direct step here, not nested in a reusable workflow or | ||
| # composite action: PyPI trusted publishing checks the OIDC token's | ||
| # workflow_ref, which only matches this repo's own workflow file when the | ||
| # publish step runs at the top level (job_workflow_ref is unsupported by | ||
| # PyPI - see pypi/warehouse#11096). pypa/gh-action-pypi-publish also | ||
| # self-resolves its own docker image from github.action_repository/ | ||
| # action_ref, which breaks the same way when nested more than one level |
There was a problem hiding this comment.
suggestion: use a shorter comment, mostly pointing to PyPI doc about this limitation and work-around
and retain the detailed explanation as a comment in the JIRA issue
Suggested change
| # Intentionally a direct step here, not nested in a reusable workflow or | |
| # composite action: PyPI trusted publishing checks the OIDC token's | |
| # workflow_ref, which only matches this repo's own workflow file when the | |
| # publish step runs at the top level (job_workflow_ref is unsupported by | |
| # PyPI - see pypi/warehouse#11096). pypa/gh-action-pypi-publish also | |
| # self-resolves its own docker image from github.action_repository/ | |
| # action_ref, which breaks the same way when nested more than one level | |
| # using a reusable workflow or composite action is not support by PyPI. See ... |
Comment on lines
+69
to
+76
| # Intentionally a direct step here, not nested in a reusable workflow or | ||
| # composite action: PyPI trusted publishing checks the OIDC token's | ||
| # workflow_ref, which only matches this repo's own workflow file when the | ||
| # publish step runs at the top level (job_workflow_ref is unsupported by | ||
| # PyPI - see pypi/warehouse#11096). pypa/gh-action-pypi-publish also | ||
| # self-resolves its own docker image from github.action_repository/ | ||
| # action_ref, which breaks the same way when nested more than one level | ||
| # deep (see MiraGeoscience/CI-tools DEVOPS-1154 and actions/runner#2473). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DEVOPS-1154 - address warnings upon publishing Python packages from GitHub