Repository navigation
docs: document protected PyPI publishing - #789
Open
zhongkechen wants to merge 10 commits into
Open
zhongkechen wants to merge 10 commits into
zhongkechen wants to merge 10 commits into
Conversation
zhongkechen
temporarily deployed
to
ai-pr-review-runtime
October 19, 2026 23:25 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
zhongkechen
temporarily deployed
to
ai-pr-review-runtime
October 19, 2026 23:26 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This comment has been minimized.
This comment has been minimized.
zhongkechen
changed the title
zhongkechen
temporarily deployed
to
ai-pr-review-runtime
October 19, 2026 23:46 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This comment has been minimized.
This comment has been minimized.
zhongkechen
temporarily deployed
to
ai-pr-review-runtime
October 20, 2026 19:44 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This comment has been minimized.
This comment has been minimized.
zhongkechen
temporarily deployed
to
ai-pr-review-runtime
October 21, 2026 00:10 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This comment has been minimized.
This comment has been minimized.
zhongkechen
temporarily deployed
to
ai-pr-review-runtime
October 21, 2026 17:13 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This comment has been minimized.
This comment has been minimized.
zhongkechen
temporarily deployed
to
ai-pr-review-runtime
October 22, 2026 16:02 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This comment has been minimized.
This comment has been minimized.
zhongkechen
temporarily deployed
to
ai-pr-review-runtime
October 23, 2026 21:01 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This comment has been minimized.
This comment has been minimized.
zhongkechen
temporarily deployed
to
ai-pr-review-runtime
October 23, 2026 23:50 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This comment has been minimized.
This comment has been minimized.
Comment on lines
+120
to
+122
| also triggers [`ecr-release.yml`](.github/workflows/ecr-release.yml), which | ||
| publishes the testing emulator image. Do not create a GitHub release solely to | ||
| claim one name if those other publications are not intended. |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment has been minimized.
This comment has been minimized.
Contributor
Codex AI reviewNo actionable findings after reviewing the complete diff against CONTRIBUTING rules 1–9. The prior emulator-publication finding is resolved. Documentation-only change; tests were not run, and live GitHub/PyPI settings were not independently verified. Reviewed commit |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Document how to publish a new or renamed Python distribution to PyPI for the first time: the exact trusted-publisher form values, initial version selection, when the name is claimed, and verification after upload.
Align the release process with the repository's protections. The
pypienvironment accepts only the four configured release-tag patterns, and tag creation is governed by the protected-tags ruleset. Explain why branch runs cannot publish, require the tag to point at the merged commit whose CI passed, treat published tags as immutable, and configure new prefixes in both sets of rules.Clarify that a release publishes every PyPI matrix entry. After PyPI publishing succeeds, the emulator workflow publishes an image only when the release tag includes
testing-v<version>. Publishing a single new package requires reviewed workflow changes compatible with the protected tag process; PyPI organization project creation remains an option for claiming only the name.Validation: compared the instructions with the live
pypienvironment deployment policies, protected-tags ruleset, and current workflows. Checked GitHub Markdown rendering and local links/anchors.git diff --checkand commit-message lint pass. Documentation only; SDK tests were not run.