From 3f2601bf01b81bae54f7c2a11002240a0b3788a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Fri, 23 Oct 2026 13:50:20 -0700 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20fix(lock):=20review=20release-cr?= =?UTF-8?q?eator=200.6.6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PyPI published the later sdist at 20:48:23.221567 UTC. Review a 20:48:24 UTC cutoff so callers can lock this version during the seven-day cooldown. --- README.md | 8 ++++---- changelog.d/+correct-action-contract.doc.md | 1 + changelog.d/+review-release-creator-066.change.md | 1 + tests/refresh_release_lock/test_cutoffs.py | 12 +++++++++++- tools/nab_cutoffs.py | 1 + 5 files changed, 18 insertions(+), 5 deletions(-) create mode 100644 changelog.d/+correct-action-contract.doc.md create mode 100644 changelog.d/+review-release-creator-066.change.md diff --git a/README.md b/README.md index 219b48f..4a16ef3 100644 --- a/README.md +++ b/README.md @@ -214,7 +214,7 @@ The tag starts the caller's publisher. Keep PyPI trusted publishing in that top- read-only job alongside the tagged-source build, and make publishing depend on both. Repositories with the standard `uv` wheel and sdist build can call `validate-python-release.yaml` in the tag publisher. The [self-release workflow](.github/workflows/release.yaml) shows the GitHub Release path; callers keep their ecosystem -uploads. The read-only build workflow checks the tagged source and renders the Release body. The tag caller alone has a +uploads. The read-only build workflow checks the tagged source. The tag caller renders the Release body and has the only Contents write job that creates the GitHub Release. ## Validate a Python release @@ -474,9 +474,9 @@ checkout or GitHub state. tag: ${{ github.ref_name }} ``` -`tag` is required. `executable` defaults to `release-creator` on `PATH` and accepts a path to a locked installation. The -`previous` output is empty when this is the first matching release. Pass it as `previous_tag_name` to GitHub's -generated-notes endpoint only when nonempty. +`tag` is required. Install `release-creator` on `PATH` before calling the Action. The `previous` output is empty when +this is the first matching release. Pass it as `previous_tag_name` to GitHub's generated-notes endpoint only when +nonempty. ## Reconcile PyPI artifacts diff --git a/changelog.d/+correct-action-contract.doc.md b/changelog.d/+correct-action-contract.doc.md new file mode 100644 index 0000000..9bb5f57 --- /dev/null +++ b/changelog.d/+correct-action-contract.doc.md @@ -0,0 +1 @@ +Correct the documented release validation and previous-tag Action interfaces. diff --git a/changelog.d/+review-release-creator-066.change.md b/changelog.d/+review-release-creator-066.change.md new file mode 100644 index 0000000..0d7dbce --- /dev/null +++ b/changelog.d/+review-release-creator-066.change.md @@ -0,0 +1 @@ +Accept release-creator 0.6.6 in caller locks under its reviewed PyPI upload cutoff. diff --git a/tests/refresh_release_lock/test_cutoffs.py b/tests/refresh_release_lock/test_cutoffs.py index f50760d..388c3df 100644 --- a/tests/refresh_release_lock/test_cutoffs.py +++ b/tests/refresh_release_lock/test_cutoffs.py @@ -64,7 +64,15 @@ def test_expire_cutoffs_removes_empty_package_table(cutoff_project: Path) -> Non assert "packages" not in tomllib.loads(updated)["tool"]["nab"] -@pytest.mark.parametrize("reviewed", ["2026-10-23T02:44:40Z", "2026-10-23T16:52:06Z"]) +@pytest.mark.parametrize( + "reviewed", + [ + pytest.param("2026-10-23T02:44:40Z", id="0.6.0"), + pytest.param("2026-10-23T16:52:06Z", id="0.6.4"), + pytest.param("2026-10-23T19:54:50Z", id="0.6.5"), + pytest.param("2026-10-23T20:48:24Z", id="0.6.6"), + ], +) def test_expire_cutoffs_removes_each_reviewed_release_creator_floor(reviewed: str) -> None: project = ( '[tool.nab]\nuploaded-prior-to = "P7D"\n' @@ -202,6 +210,8 @@ def test_check_nab_lock_rejects_forged_upload_time( pytest.param("release-creator", "2026-10-23T16:52:07Z", False, id="extended-release-creator"), pytest.param("release-creator", "2026-10-23T19:54:50Z", True, id="reviewed-release-creator-0.6.5"), pytest.param("release-creator", "2026-10-23T19:54:51Z", False, id="extended-release-creator-0.6.5"), + pytest.param("release-creator", "2026-10-23T20:48:24Z", True, id="reviewed-release-creator-0.6.6"), + pytest.param("release-creator", "2026-10-23T20:48:25Z", False, id="extended-release-creator-0.6.6"), pytest.param("unreviewed", "2026-10-22T00:00:00Z", False, id="new-package"), ], ) diff --git a/tools/nab_cutoffs.py b/tools/nab_cutoffs.py index f33dc38..9a8f03b 100644 --- a/tools/nab_cutoffs.py +++ b/tools/nab_cutoffs.py @@ -23,6 +23,7 @@ ("release-creator", "0.6.0"): datetime(2026, 10, 23, 2, 44, 40, tzinfo=UTC), ("release-creator", "0.6.4"): datetime(2026, 10, 23, 16, 52, 6, tzinfo=UTC), ("release-creator", "0.6.5"): datetime(2026, 10, 23, 19, 54, 50, tzinfo=UTC), + ("release-creator", "0.6.6"): datetime(2026, 10, 23, 20, 48, 24, tzinfo=UTC), ("uv-build", "0.13.4"): datetime(2026, 10, 21, tzinfo=UTC), } _REVIEWED_EXCEPTIONS: Final = {