Port the CI follow-ups from pynwb #2262 - #1577
Draft
rly wants to merge 6 commits into
Draft
Conversation
Give every job a `timeout-minutes` backstop in place of the 6-hour default, sized at roughly three times the maximum runtime measured over recent successful runs. Reference the composite action with GitHub's self-repository `$/` syntax, which resolves to the running commit with no checkout and satisfies zizmor's self-repository audit. deploy_release.yml uses the composite action too, rather than repeating the Python and tox setup. Turn pip caching off for the two jobs whose distributions are published, so a release and the rolling "latest" pre-release are built from a cold cache; setup-python-tox takes a `pip-cache` input to select this. Skip the Codecov upload on a pull request from a fork. CODECOV_TOKEN is not exposed there, and `fail_ci_if_error: true` turned that into a failure on every external contributor's pull request. The tests themselves still run. Run zizmor through zizmor-action, which carries the zizmor version it runs pinned by container image digest, so Dependabot keeps zizmor current by bumping the action. A version inside a `run:` step is invisible to Dependabot and has to be bumped by hand. Expire the `distributions` artifact after a day, since the deploy-dev job consumes it within the same run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dev #1577 +/- ##
=======================================
Coverage 93.18% 93.18%
=======================================
Files 41 41
Lines 10269 10269
Branches 2126 2126
=======================================
Hits 9569 9569
Misses 421 421
Partials 279 279 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The filter was written as a regular expression, but GitHub matches tag filters as globs, so it matched no tag and the workflow only ever ran on its schedule and on manual dispatch. The full test matrix therefore never ran when a release tag was pushed. Use the same pattern deploy_release.yml already uses, which is what pynwb settled on in NeurodataWithoutBorders/pynwb#2246. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
hdmf builds emit Metadata-Version 2.5, which PyPI rejected for pynwb until the publish action caught up. Nothing in CI validates the metadata, so a problem of that kind surfaces during the release upload. Run `twine check --strict` on the built distributions wherever they are built, with twine pinned to the version pypa/gh-action-pypi-publish bundles so the check and the upload apply the same validation. Follows NeurodataWithoutBorders/pynwb#2260. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ruff, codespell and generate-extension-matrix were the last pull request jobs without one, which closes zizmor's remaining concurrency-limits findings other than the two jobs that should not have a group: deploy_release, where a release upload must not be cancelled mid-flight, and project_action, where every issues event shares a ref and so would share a group, letting one opened issue cancel another's board assignment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Coding agents keep their per-repository settings and local state there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Brings hdmf in line with the CI work in NeurodataWithoutBorders/pynwb#2262, which started as a port of #1518 and picked up several follow-ups along the way. The
permissions, action pins,persist-credentials, Dependabot config and zizmor policy already match between the two repos; this is the remainder.Three points that are not self-evident from the diff:
uses: $/...is GitHub's self-repository syntax, GA since 2026-07-30 and requiring runner ≥ 2.336.0 (hosted runners are on 2.337.0). It resolves to the running commit with no checkout, and satisfies zizmor'sself-repositoryaudit, which is new in 1.30 and reports the current./refs.actionlint1.7.12 predates it and calls it malformed; we do not run actionlint in CI. It is exercised and passing on pynwb#2262.zizmor==1.26.1pin inside arun:step was the one pin in.github/that Dependabot could not see.advanced-security: falsekeeps the job atcontents: read.Also fixes a separate, pre-existing bug found while comparing the two repos:
run_all_tests.ymlwrote its tag filter as a regular expression, but GitHub matches tag filters as globs, so it matched no tag. The run history confirms it, with zeropushevents in the last 40 runs, meaning the full test matrix has never run on a release tag. It now uses the same patterndeploy_release.ymlalready uses, which is what pynwb settled on in NeurodataWithoutBorders/pynwb#2246.One item from pynwb#2262 is deliberately not ported: shallow-cloning the downstream repos in
run_pynwb_tests.ymlandrun_hdmf_zarr_tests.yml. Both usehatch-vcswithdynamic = ["version"], so--depth 1would strip the tags they derive their version from. It was safe in pynwb only because nwbinspector pins its version statically.How to test the behavior?
Passes with no findings, offline and online. The rest is exercised by this PR's own CI.
Checklist
CHANGELOG.mdwith your changes?🤖 Generated with Claude Code