From 44590f5e6c500a43ae238de63d4c4b4cec49fdc2 Mon Sep 17 00:00:00 2001 From: irfanuddinahmad Date: Wed, 2 Sep 2026 16:17:43 +0500 Subject: [PATCH 1/2] fix: pin release.yml action refs to SHAs and match sample-plugin conformance release.yml (added in #425, touched again in #434/#435/#436/#438) had drifted from the org's gold-standard reference (sample-plugin's release.yml): python-semantic-release, actions/upload-artifact and actions/download-artifact were on floating version tags (@v10.6.2, @v7, @v8) instead of pinned commit SHAs, defeating the whole point of the pin-actions-to-sha effort (this repo's own #407) for the one workflow that runs unreviewed on every push to master. Also: - Drop `fetch-depth: 0` from the release job's checkout: python-semantic- release auto-deepens a shallow clone itself before evaluating version history, so it's never needed here (confirmed against sample-plugin). - Add `if-no-files-found: error` to the dist upload step so a build that silently produces no artifacts fails loudly instead of shipping an empty release. - Add the `github.ref_name == 'master'` guard to publish_to_pypi's `if:`, matching sample-plugin, even though this workflow currently only triggers on push to master. All three added SHAs were independently verified against the upstream repos via `gh api repos///commits/` and cross-checked against their claimed tags (resolving through the annotated tag object for python-semantic-release@v10.6.2, which points at commit 9a026e9303981c866c3425723009becb2437c757). Co-Authored-By: Claude Sonnet 5 --- .github/workflows/release.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 039aba2..6a7ef9d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,13 +25,12 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.ref_name }} - fetch-depth: 0 - run: git reset --hard ${{ github.sha }} - name: Python Semantic Release id: release - uses: python-semantic-release/python-semantic-release@v10.6.2 + uses: python-semantic-release/python-semantic-release@9a026e9303981c866c3425723009becb2437c757 # v10.6.2 with: github_token: ${{ secrets.OPENEDX_SEMANTIC_RELEASE_GITHUB_TOKEN }} git_committer_name: "github-actions" @@ -63,21 +62,22 @@ jobs: - name: Upload dist artifacts if: steps.release.outputs.released == 'true' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dist path: dist/ + if-no-files-found: error publish_to_pypi: runs-on: ubuntu-latest needs: release - if: needs.release.outputs.released == 'true' + if: github.ref_name == 'master' && needs.release.outputs.released == 'true' permissions: id-token: write steps: - name: Download dist artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dist path: dist/ From d113e6a3a3a249a15b974293ad59e0adc4b954b2 Mon Sep 17 00:00:00 2001 From: irfanuddinahmad Date: Wed, 2 Sep 2026 16:18:00 +0500 Subject: [PATCH 2/2] fix: drop unneeded fetch-depth: 0 from ci.yml checkout Nothing in this package reads __version__ at runtime (setuptools_scm's dynamic version, with fallback_version = "0.0.0", is only ever consumed via package metadata, never parsed from a module attribute), so there's no analog to the openedx-events EventData.sourcelib case where a shallow clone breaks version resolution. Sample-plugin's own backend-ci.yml doesn't set fetch-depth: 0 either. A full clone on every CI run buys nothing here and just makes checkout slower. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index baf7517..11052ed 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,8 +19,6 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - name: Install uv uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1