✅ Issue #10 Analysis: Trusted Publishing Resolution #12

konard · 2025-12-09T07:11:00Z

🎯 Summary

This PR implements support for a single Python runtime version (Python 3.13, the latest stable) and adds a comprehensive release workflow similar to test-anywhere, adapted for Python packages with PyPI trusted publishing.

Fixes #3

📝 Changes

1. Python Version Support

✅ Updated pyproject.toml to require Python >=3.13
✅ Updated classifiers to only list Python 3.13
✅ Updated ruff target-version to py313
✅ Updated mypy python_version to 3.13
✅ Updated test.yml workflow to test only Python 3.13
✅ Applied ruff auto-fixes for modern Python 3.13 syntax

2. Release Workflow Infrastructure

✅ Created release.yml workflow supporting:
- Automated changeset-based releases to PyPI
- Manual instant releases (patch/minor/major)
- Manual changeset PR creation
- PyPI OIDC trusted publishing (no tokens needed)
- Comprehensive lint, format, and test checks

3. Changeset System

✅ Set up .changeset/ configuration for version management
✅ Created root package.json with changeset dependencies and scripts
✅ Downloaded all release scripts from test-anywhere repository

4. Python-Specific Scripts

Created adapted scripts for Python package management:

publish-to-pypi.mjs - PyPI publishing with OIDC trusted publishing
update-python-version.mjs - Version bumping from changesets
create-github-release-python.mjs - GitHub releases from CHANGELOG.md

5. Documentation

✅ Added python/CHANGELOG.md for tracking releases
✅ Added .changeset/README.md with usage instructions

🚀 How It Works

Automated Release Flow

Developer creates a changeset: npm run changeset
Changeset is committed with code changes
PR is merged to main
CI automatically:
- Bumps version in pyproject.toml
- Updates CHANGELOG.md
- Publishes to PyPI via OIDC trusted publishing
- Creates GitHub release

Manual Release Options

Instant Release: Trigger via GitHub Actions UI for immediate patch/minor/major release
Changeset PR: Create a PR with a changeset for review before release

🔒 Security

Uses PyPI OIDC trusted publishing (no API tokens needed)
Requires only id-token: write permission
Single workflow file as trusted publisher (PyPI requirement)

✅ Testing

All Python tests pass (12/12) ✅
Ruff linting passes ✅
Local CI checks verified ✅

📚 References

Based on test-anywhere release workflow
Adapted for Python packaging ecosystem
Supports PyPI trusted publishing as requested

Fixes #10

Adding CLAUDE.md with task information for AI processing. This file will be removed when the task is complete. Issue: #10

- Complete timeline of E422 and E404 errors - Root cause analysis for both failure scenarios - Comparison with test-anywhere workflows - Authentication strategies comparison - Recommendations for future improvements References test-anywhere workflows for comparison. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

This reverts commit bc8b0a2.

konard · 2025-12-09T07:17:26Z

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

Public pricing estimate: $1.700427 USD
Calculated by Anthropic: $1.179073 USD
Difference: $-0.521354 (-30.66%)
📎 Log file uploaded as GitHub Gist (433KB)
🔗 View complete solution draft log

Now working session is ended, feel free to review and add any feedback on the solution draft.

konard · 2025-12-09T07:24:19Z

Run # Publish to npm using OIDC trusted publishing
npm warn Unknown user config "always-auth". This will stop working in the next major version of npm.

> lino-arguments@0.2.6 changeset:publish
> changeset publish

🦋  info npm info lino-arguments
🦋  info lino-arguments is being published because our local version (0.2.6) has not been published on npm
🦋  info Publishing "lino-arguments" at "0.2.6"
🦋  error an error occurred while publishing lino-arguments: E404 Not Found - PUT https://registry.npmjs.org/lino-arguments - Not found 
🦋  error The requested resource 'lino-arguments@0.2.6' could not be found or you do not have permission to access it.
🦋  error 
🦋  error Note that you can also install from a
🦋  error tarball, folder, http url, or git url.
🦋  error npm warn Unknown user config "always-auth". This will stop working in the next major version of npm.
🦋  error 
🦋  error > lino-arguments@0.2.6 prepare
🦋  error > husky || true
🦋  error 
🦋  error npm warn gitignore-fallback No .npmignore file found, using .gitignore for file exclusion. Consider creating a .npmignore file to explicitly control published files.
🦋  error npm warn gitignore-fallback No .npmignore file found, using .gitignore for file exclusion. Consider creating a .npmignore file to explicitly control published files.
🦋  error npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
🦋  error npm warn publish errors corrected:
🦋  error npm warn publish "repository.url" was normalized to "git+https://github.com/link-foundation/lino-arguments.git"
🦋  error npm notice SECURITY NOTICE: Classic tokens expire December 9. Granular tokens now limited to 90 days with 2FA enforced by default. Update your CI/CD workflows to avoid disruption. Learn more: https://gh.io/npm-token-changes
🦋  error npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
🦋  error npm notice Access token expired or revoked. Please try logging in again.
🦋  error npm error code E404
🦋  error npm error 404 Not Found - PUT https://registry.npmjs.org/lino-arguments - Not found
🦋  error npm error 404
🦋  error npm error 404  The requested resource 'lino-arguments@0.2.6' could not be found or you do not have permission to access it.
🦋  error npm error 404
🦋  error npm error 404 Note that you can also install from a
🦋  error npm error 404 tarball, folder, http url, or git url.
🦋  error npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-12-09T07_03_41_998Z-debug-0.log
🦋  error 
🦋  error packages failed to publish:
🦋  lino-arguments@0.2.6
Error: Process completed with exit code 1.

Manual instant release does not work also: https://github.com/link-foundation/lino-arguments/actions/runs/20054899930/job/57518072639

Double check we use common.yml and workflows similar to https://github.com/link-foundation/test-anywhere

We need to have release description and release creation itself be unified between all our workflows.

Please download all logs and data related about the issue to this repository, make sure we compile that data to ./docs/case-studies folder, and use it to do deep case study analysis (also make sure to search online for additional facts and data), in which we will reconstruct timeline/sequence of events, find root causes of the problem, and propose possible solutions.

konard · 2025-12-09T07:24:59Z

🤖 AI Work Session Started

Starting automated work session at 2025-12-09T07:24:57.557Z

The PR has been converted to draft mode while work is in progress.

This comment marks the beginning of an AI work session. Please wait working session to finish, and provide your feedback.

konard · 2025-12-09T07:26:59Z

❌ Usage Limit Reached

The AI tool has reached its usage limit. The limit will reset at: 10:00 AM

This session has failed because --auto-continue-on-limit-reset was not enabled.

To automatically wait for the limit to reset and continue, use:

./solve.mjs "https://github.com/link-foundation/lino-arguments/issues/10" --resume c9d650ed-8120-40a7-ac73-2d666ba202da --auto-continue-on-limit-reset

konard · 2025-12-09T21:21:51Z

🤖 AI Work Session Started

Starting automated work session at 2025-12-09T21:21:50.804Z

The PR has been converted to draft mode while work is in progress.

This comment marks the beginning of an AI work session. Please wait working session to finish, and provide your feedback.

- Enhanced issue #10 analysis with detailed E404 error investigation - Added evidence-based findings from online research about OIDC trusted publishing - Documented workflow_dispatch authentication issues with npm - Compared authentication strategies (NPM_TOKEN vs OIDC vs Hybrid) - Added workflow comparison with test-anywhere reference repository - Proposed multiple solutions with trade-off analysis - Added changeset for documentation changes Key findings: - E422 error (missing repository field) is resolved - E404 error for manual releases linked to OIDC/workflow_dispatch incompatibility - test-anywhere uses NPM_TOKEN which works for all trigger types - Multiple solution options documented with pros/cons Related: Issue #10, PR #11 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

- Applied prettier formatting to comprehensive analysis document - Formatted changeset file 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

konard · 2025-12-09T21:37:25Z

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

Public pricing estimate: $4.186465 USD
Calculated by Anthropic: $2.166715 USD
Difference: $-2.019751 (-48.24%)
📎 Log file uploaded as GitHub Gist (669KB)
🔗 View complete solution draft log

Now working session is ended, feel free to review and add any feedback on the solution draft.

konard · 2025-12-13T12:37:36Z

Please use latest version of workflow in http://github.com/link-foundation/test-anywhere as our main workflow in the repository.

Try to do it as close as possible to actual release.yml from test-anywhere.

Also make sure we use test-anywhere itself as testing framework.

konard · 2025-12-13T12:38:03Z

🤖 AI Work Session Started

Starting automated work session at 2025-12-13T12:38:01.723Z

The PR has been converted to draft mode while work is in progress.

This comment marks the beginning of an AI work session. Please wait working session to finish, and provide your feedback.

- Replace main.yml and manual-release.yml with single release.yml workflow - Adopt test-anywhere release workflow pattern for unified CI/CD - Add missing scripts from test-anywhere: setup-npm, version-and-commit, publish-to-npm, create-github-release, format-github-release - Migrate tests to use test-anywhere API (expect/assert) - Support 3 runtimes (Node, Bun, Deno) x 3 OS (Ubuntu, macOS, Windows) test matrix - Consolidate manual release and automated release into single workflow file - This addresses npm trusted publishing requirements where only ONE workflow can be authorized 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

- Add 'fetch' to ESLint globals (Node.js 18+ native API) - Remove unused 'assert' import from tests - Use catch block without error parameter (intentionally ignored) - Install dependencies with npm before running Bun/Deno tests - This ensures test-anywhere package is available in all runtime environments 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

Deno requires explicit permission flags to access environment variables and write to filesystem. The tests need: - --allow-env: for process.env access (used by yargs and test setup) - --allow-write: for creating test files - --allow-read: for reading test files (already present) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

konard · 2025-12-13T12:49:53Z

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

Public pricing estimate: $4.325172 USD
Calculated by Anthropic: $1.909698 USD
Difference: $-2.415474 (-55.85%)
📎 Log file uploaded as GitHub Gist (796KB)
🔗 View complete solution draft log

Now working session is ended, feel free to review and add any feedback on the solution draft.

Initial commit with task details

bc8b0a2

Adding CLAUDE.md with task information for AI processing. This file will be removed when the task is complete. Issue: #10

konard self-assigned this Dec 9, 2025

konard changed the title ~~[WIP] Trusted publishing does not work in our CI/CD~~ ✅ Issue #10 Analysis: Trusted Publishing Resolution Dec 9, 2025

konard marked this pull request as ready for review December 9, 2025 07:16

Revert "Initial commit with task details"

163cca8

This reverts commit bc8b0a2.

konard marked this pull request as draft December 9, 2025 07:24

konard mentioned this pull request Dec 9, 2025

We need to make sure we actually upload logs for limit reached comment link-assistant/hive-mind#899

Open

konard and others added 2 commits December 9, 2025 22:28

style: format markdown files with prettier

2c418cd

- Applied prettier formatting to comprehensive analysis document - Formatted changeset file 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

konard marked this pull request as ready for review December 9, 2025 21:37

konard marked this pull request as draft December 13, 2025 12:38

konard and others added 3 commits December 13, 2025 13:42

konard marked this pull request as ready for review December 13, 2025 12:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

✅ Issue #10 Analysis: Trusted Publishing Resolution #12

✅ Issue #10 Analysis: Trusted Publishing Resolution #12

konard commented Dec 9, 2025 •

edited

Loading

Uh oh!

konard commented Dec 9, 2025

Uh oh!

konard commented Dec 9, 2025

Uh oh!

konard commented Dec 9, 2025

Uh oh!

konard commented Dec 9, 2025

Uh oh!

konard commented Dec 9, 2025

Uh oh!

konard commented Dec 9, 2025

Uh oh!

konard commented Dec 13, 2025

Uh oh!

konard commented Dec 13, 2025

Uh oh!

konard commented Dec 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

✅ Issue #10 Analysis: Trusted Publishing Resolution #12

Are you sure you want to change the base?

✅ Issue #10 Analysis: Trusted Publishing Resolution #12

Conversation

konard commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎯 Summary

📝 Changes

1. Python Version Support

2. Release Workflow Infrastructure

3. Changeset System

4. Python-Specific Scripts

5. Documentation

🚀 How It Works

Automated Release Flow

Manual Release Options

🔒 Security

✅ Testing

📚 References

Uh oh!

konard commented Dec 9, 2025

🤖 Solution Draft Log

Uh oh!

konard commented Dec 9, 2025

Uh oh!

konard commented Dec 9, 2025

Uh oh!

konard commented Dec 9, 2025

Uh oh!

konard commented Dec 9, 2025

Uh oh!

konard commented Dec 9, 2025

🤖 Solution Draft Log

Uh oh!

konard commented Dec 13, 2025

Uh oh!

konard commented Dec 13, 2025

Uh oh!

konard commented Dec 13, 2025

🤖 Solution Draft Log

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

konard commented Dec 9, 2025 •

edited

Loading