fix(release): repair shim publishing for pypi and rubygem#378
Closed
rhuanbarreto wants to merge 1 commit into
Closed
fix(release): repair shim publishing for pypi and rubygem#378rhuanbarreto wants to merge 1 commit into
rhuanbarreto wants to merge 1 commit into
Conversation
The v0.41.0 Publish Shims run failed two jobs: - publish-pypi: `pip install build --hash=...` errored with `no such option: --hash` — `--hash` is only valid inside a requirements file, not on the pip command line. Switch to `uv build`, which provisions its own pinned, isolated build environment, removing the unpinned `pip install build` line entirely (Scorecard Pinned-Dependencies stays satisfied). - publish-rubygem: `bundle exec rake release` failed with `rake is not currently included in the bundle` because Ruby 4.0 no longer ships rake as a bundled default gem. Declare it in the Gemfile. Both fixes validated locally: `uv build` + `twine check` pass, and `bundle install` + `bundle exec rake -T` (showing `release[remote]`) pass in a ruby:4.0 container. Signed-off-by: Rhuan Barreto <rhuan@barreto.work>
Deploying archgate-cli with
|
| Latest commit: |
a54773b
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://282cfe9c.archgate-cli.pages.dev |
| Branch Preview URL: | https://claude-peaceful-napier-6de51.archgate-cli.pages.dev |
Contributor
Code Coverage
Full HTML report available in workflow artifacts. Per-directory breakdown
|
rhuanbarreto
added a commit
that referenced
this pull request
May 29, 2026
- Use `uv build --python 3.12` instead of action-level python-version - Use pessimistic `~> 13.0` constraint for rake (idiomatic Ruby) - Add comments explaining why rake and uv build are needed Signed-off-by: Rhuan Barreto <rhuan@barreto.work>
Contributor
Author
|
Consolidated into #377 — adopted all improvements (uv build --python 3.12, ~> 13.0 rake constraint, comments, detailed memory notes). |
2 tasks
rhuanbarreto
added a commit
that referenced
this pull request
May 29, 2026
* fix(shims): fix rubygem and pypi publish failures Ruby 4.0 removed rake from default gems — add it to the Gemfile. pip 25.1+ dropped --hash as a CLI argument — move hash-pinned build deps to a requirements file where --hash is still supported. Signed-off-by: Rhuan Barreto <rhuan@barreto.work> * refactor(shims): replace pip with uv for pypi build uv build handles the entire sdist+wheel pipeline from pyproject.toml without needing a separate build dep install step. Eliminates the pip --hash compatibility issue entirely. Locally validated: uv build produces archgate-0.41.0 sdist + wheel. Signed-off-by: Rhuan Barreto <rhuan@barreto.work> * refactor(shims): adopt PR #378 improvements - Use `uv build --python 3.12` instead of action-level python-version - Use pessimistic `~> 13.0` constraint for rake (idiomatic Ruby) - Add comments explaining why rake and uv build are needed Signed-off-by: Rhuan Barreto <rhuan@barreto.work> * fix(shims): move python-version back to action input Keep python-version as a setup-uv action input so Renovate/Dependabot can detect and bump it automatically. Signed-off-by: Rhuan Barreto <rhuan@barreto.work> * docs(memory): update shim publishing notes with v0.41.0 root causes Document pip --hash CLI removal and Ruby 4.0 rake default gem removal so future agents don't reintroduce the broken patterns. Signed-off-by: Rhuan Barreto <rhuan@barreto.work> --------- Signed-off-by: Rhuan Barreto <rhuan@barreto.work>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The v0.41.0 Publish Shims run failed two independent jobs. Both are first-time regressions that only surface at release time (the workflow does not run on PRs).
publish-pypi—pip install 'build==1.5.0' --hash=...errored withno such option: --hash.--hashis only valid inside a requirements file, never on the pip command line, so the form introduced in fix(ci): pin pip build dependency by hash for Scorecard compliance #361 was broken. Switched touv build(via SHA-pinnedastral-sh/setup-uv), which provisions its own pinned, isolated build environment — this removes the unpinnedpip install buildline entirely, so the Scorecard Pinned-Dependencies concern from fix(ci): pin pip build dependency by hash for Scorecard compliance #361 stays satisfied without the hash dance.publish-rubygem—bundle exec rake releasefailed withrake is not currently included in the bundlebecause the runner moved to Ruby 4.0, which no longer shipsrakeas a bundled default gem. Declaredgem "rake", "~> 13.0"in the Gemfile.Test plan
uv build --python 3.12builds sdist + wheel;twine checkpassesbundle installresolves andbundle exec rake -Tlistsrelease[remote]in aruby:4.0container (Ruby 4.0.5)archgate checkpasses (39/39), including CI-001 action-pinning for the newsetup-uvrefoxfmt --check .passesNote on re-running v0.41.0
The already-succeeded jobs (maven, go-tag, nuget) are not idempotent and will fail on "already exists" if the whole workflow is re-run. Cleanest path is to land this and cut v0.41.1, or manually publish only the PyPI + RubyGem shims for v0.41.0.