Summary
Commit e143cce15ceaeb6ef86f9af4accf703a9a8c3b0d removed the "Require green checks on the commit being published" step from .github/workflows/release-publish.yml.
The current manual release path validates the release/v* naming pattern, checks out the selected ref, builds it, and publishes with PYPI_TOKEN, but I could not find an equivalent exact-SHA CI/status requirement before publication.
Current flow
workflow_dispatch
-> validate release/v* ref
-> checkout
-> uv build
-> uv publish
The removed gate previously queried check-runs for the exact commit and failed when:
- no checks had reported, or
- any relevant check was not green.
Reproduction / verification
This was verified using repository source and public GitHub metadata only:
- Inspect the diff for
e143cce15ceaeb6ef86f9af4accf703a9a8c3b0d.
- Inspect the current
.github/workflows/release-publish.yml.
- Confirm the removed exact-SHA green-check validation has no equivalent replacement in the workflow.
- Check public branch/ruleset metadata for the
release/v* path.
- Check
release-artifact-check.yml and whether it is required for publication.
No release workflow was triggered, no branch was modified, no secret was accessed, and nothing was published to PyPI.
Expected behavior
A package release should require a deterministic validation step for the exact commit being published, or an equivalent protected-environment / required-check mechanism.
Actual behavior
The workflow can proceed from an eligible release ref to build and publish without re-establishing that the exact commit has passed the project CI checks.
Why this matters
This weakens release-integrity guarantees and makes the publish workflow dependent on repository/Actions permissions and branch policy rather than an explicit release-time validation of the artifact source revision.
If another protection mechanism is intentionally relied on here, documenting that invariant in the workflow would make the release trust boundary clearer.
Summary
Commit
e143cce15ceaeb6ef86f9af4accf703a9a8c3b0dremoved the "Require green checks on the commit being published" step from.github/workflows/release-publish.yml.The current manual release path validates the
release/v*naming pattern, checks out the selected ref, builds it, and publishes withPYPI_TOKEN, but I could not find an equivalent exact-SHA CI/status requirement before publication.Current flow
The removed gate previously queried check-runs for the exact commit and failed when:
Reproduction / verification
This was verified using repository source and public GitHub metadata only:
e143cce15ceaeb6ef86f9af4accf703a9a8c3b0d..github/workflows/release-publish.yml.release/v*path.release-artifact-check.ymland whether it is required for publication.No release workflow was triggered, no branch was modified, no secret was accessed, and nothing was published to PyPI.
Expected behavior
A package release should require a deterministic validation step for the exact commit being published, or an equivalent protected-environment / required-check mechanism.
Actual behavior
The workflow can proceed from an eligible release ref to build and publish without re-establishing that the exact commit has passed the project CI checks.
Why this matters
This weakens release-integrity guarantees and makes the publish workflow dependent on repository/Actions permissions and branch policy rather than an explicit release-time validation of the artifact source revision.
If another protection mechanism is intentionally relied on here, documenting that invariant in the workflow would make the release trust boundary clearer.