Repository navigation
Publish release v0.79.0 - #1069
Merged
Merged
Conversation
Reverted commits b7ea3ab and 10f866f because that workaround is no longer needed after the change described in the GitHub Changelog on 2026-06-11: From [GitHub Changelog → Bot-created pull requests can run workflows if approved](https://github.blog/changelog/2026-06-11-bot-created-pull-requests-can-run-workflows-if-approved/): > Pull requests created by the `github-actions[bot]` are now able to run > your CI/CD workflows with user approval. Requiring approval is a security > measure to ensure generated code does not automatically run workflows > which may have access to sensitive information. […] > > Previously, pull requests generated by `github-actions[bot]` were not > able to run CI/CD workflows, allowing pull requests to be accidentally > merged without having gone through CI. This change allows all pull requests, > even bot-generated changes, to run configured CI/CD workflows if approved > by a user with write access to the repository.
…low-for-release-and-deploy Do not trigger Git Commit Linter and Dependency Review when draft PR is ready for review
Bumps the github-actions-production group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [actions/setup-python](https://github.com/actions/setup-python) and [actions/cache](https://github.com/actions/cache). Updates `actions/checkout` from 6.0.3 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6.0.3...v7.0.0) Updates `actions/setup-python` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6.2.0...v6.3.0) Updates `actions/cache` from 5.0.5 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v5.0.5...v6.1.0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-production - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-production - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-production ... Signed-off-by: dependabot[bot] <support@github.com>
…b-actions-production-9d45b56163 chore(deps): Bump the github-actions-production group with 3 updates
- [Software Repository](https://pypi.org/project/signxml/4.3.1/) - [Release Notes](https://github.com/XML-Security/signxml/releases/tag/v4.3.1) - [Changelog](https://github.com/XML-Security/signxml/blob/v4.3.1/Changes.rst#changes-for-v431-2026-02-17) - [Commits](XML-Security/signxml@v4.2.0...v4.3.1)
deps: Update `signxml` from 4.2.0 to 4.3.1
- The workflow was a copy of the one in `lib-cl-sii-python` and `lib-cl-sii-api-python`, so a fix or an improvement had to be applied twice. - The reusable workflow is `cordada/github-actions-utils`, which already hosts the Git commit linter and Super-Linter workflows. - What this VCS repository does with a release is publish a package, not deploy it, so the workflow is renamed accordingly. - The pull request labels have to be overridden because this VCS repository still labels a publication pull request `kind: deploy`, and a label that does not exist cannot be applied.
…h-workflow workflows: Use reusable workflow for release and publication task
- The 'Task: Release and Publish' workflow now names the VCS branch `publish/vX.Y.Z` and titles the pull request `Publish release vX.Y.Z`, so the manual procedure documented here no longer matched what actually happens. - The label is `kind: publish`, which is the renamed `kind: deploy`.
- The override existed only because this VCS repository had no `kind: publish` label, which is what the reusable workflow labels a publication pull request by default. - That label now exists: `kind: deploy` was renamed rather than replaced, so the pull requests that already carried it keep it.
workflows: Label a release publication `kind: publish`
- Restore the cache before creating the Python virtual environment, and create the environment only when the cache was not restored. - The cache is restored by extracting an archive over the workspace, so restoring it over the virtual environment that the preceding step had just created merged the cached Pip installation with the one that `python -m venv` bootstraps, instead of replacing it. - The merge was harmless only while both Pip versions laid out their internal modules the same way. Pip 26.2 turned module `pip/_internal/build_env.py` into a package of the same name, so the directory left behind by the Pip that `python -m venv` bootstraps, 26.2.1 as of the current interpreters of `actions/setup-python`, now shadows the module of the Pip that this project pins, 26.0.1, and every Pip invocation in the virtual environment fails with `ImportError: cannot import name 'get_runnable_pip' from 'pip._internal.utils.misc'`. - Every job that got a cache hit was affected, which is why the `Build` job started failing on `develop` without any change to the Python build.
…ore-order workflows: Restore the dependency cache before creating the virtual environment
- Apply to workflow `release.yaml` the fix that PR #1062 applied to workflow `ci.yaml`: restore the cache before creating the Python virtual environment, and create the environment only when the cache was not restored. - The `Release` job restores the same cache over a virtual environment it has just created, which merges the Pip installation that `python -m venv` bootstraps with the cached one instead of replacing it, and fails with `ImportError: cannot import name 'get_runnable_pip' from 'pip._internal.utils.misc'` since Pip 26.2 turned module `pip/_internal/build_env.py` into a package of the same name. - The job was not covered by PR #1062 because only `ci.yaml` was inspected. It runs only on `master`, so the failure has not been observed yet and would have surfaced during the next publication. Ref: cordada/lib-cl-sii-api-python#1131
…-restore-order workflows: Restore the dependency cache before creating the virtual environment in "Release"
- Rename workflow file `deploy.yaml` to `publish.yaml`, its `name`, its job and its only step, and the caller job in `ci-cd.yaml`. - The workflow does not deploy anything: it uploads the built distribution to a package registry, which the rest of the repository already calls publishing, as in `task-release-and-publish.yaml`, the `publish/vX.Y.Z` branches, the `kind: publish` pull request label, and the note in `CONTRIBUTING.md` that by "deploy" it is meant publish to the package registry. - Keep input `deploy_env` and variable `DEPLOY_ENV` as they are, because they name the deployment environment rather than this workflow, and `release.yaml` takes the same input. - Keep Make target `deploy` as it is, because renaming it is not part of renaming the workflow. - Renaming changes the name of the check this workflow reports, and no branch protection rule of either `develop` or `master` requires it. Ref: cordada/lib-cl-sii-api-python#1132
workflows: Rename workflow "Deploy" to "Publish"
Bumps the github-actions-production group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [actions/setup-python](https://github.com/actions/setup-python). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v7.0.0...v7.0.1) Updates `actions/setup-python` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6.3.0...v7.0.0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-production - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-production ... Signed-off-by: dependabot[bot] <support@github.com>
…b-actions-production-25c580fd63 chore(deps): Bump the github-actions-production group across 1 directory with 2 updates
- Reference every third-party GitHub Action by the full commit hash of the version already in use, with that version in a trailing comment, as `codecov/codecov-action` was already referenced. - A Git tag is mutable, so `actions/checkout@v7.0.1` resolves to whatever commit the tag points at when the workflow runs, and an account takeover or a compromised release is enough to replace it with code of somebody's choosing. This repository's workflows hold the credentials that publish the package to the registry, so that code would run with them. - Dependabot keeps hash references up to date the same way it keeps tag references up to date, as long as the friendly version follows the hash as a comment, so the `github-actions` ecosystem entry in `.github/dependabot.yml` needs no change. - Reusable workflows of `cordada/github-actions-utils` are left referencing `master`, as they are internal to the organization and the branch is the reference the callers are meant to track.
…ons-4aaa56 workflows: Pin GitHub Actions to commit hashes
- Implemented enhanced encoding detection with `chardet` and fallback mechanisms to prevent decoding failures for CSV files. - This includes blocking implausible encodings, handling BOMs, and adding comprehensive unit tests for edge cases. - Adjusted related functions for seamless integration and reliability. Ref: https://app.shortcut.com/cordada/story/22218/
…g-det rtc: Fall back to a lossless encoding when parsing "cesiones periodo" files
Release v0.79.0
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
svillegas-cdd
marked this pull request as ready for review
October 1, 2026 13:53
jtrobles-cdd
approved these changes
Oct 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ref: #1067