Pin the PyPI publish action by tag, not by commit SHA - #175
Merged
Merged
Conversation
The 3.1.0 publish failed 29s in, after a clean build and before PyPI was
ever contacted:
Unable to find image
'ghcr.io/pypa/gh-action-pypi-publish:a892a5a61159132606e93a2fa6f4358831b04d26'
docker: Error response from daemon: manifest unknown
The pin was not stale -- a892a5a6 IS v1.14.2, the current latest release.
The problem is that this is a DOCKER-based action, and it builds its own
image reference out of whatever ref it was invoked with. The run log shows
`REF: a892a5a6...` becoming `ghcr.io/pypa/gh-action-pypi-publish:a892a5a6...`,
and upstream publishes images tagged by VERSION only.
Verified against the registry rather than inferred:
a892a5a6... (v1.14.2 SHA) HTTP 404
2834a314... (v1.14.1 SHA) HTTP 404
v1.14.2 HTTP 200
v1.14.1 HTTP 200
So SHA-pinning this action could never have worked, for any release.
Every other action in this workflow stays SHA-pinned. checkout,
setup-python and upload-artifact are JavaScript actions, where the ref
selects code and pinning by SHA is exactly right. The distinction is now a
comment above the step, because "why is this one different" is the obvious
review question.
Nothing was published: PyPI's latest is still 3.0.0 and 3.1.0 is absent, so
the version number is still free and the release can be re-cut once this
lands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What happened
The 3.1.0 publish failed 29 seconds in — after a clean build, and before PyPI was ever contacted:
The pin was not stale
a892a5a6is v1.14.2, the current latest release of the action. The problem is that this is a Docker-based action: it derives its own image reference from whatever ref it was invoked with. The run log showsREF: a892a5a6…becomingghcr.io/pypa/gh-action-pypi-publish:a892a5a6…, and upstream publishes images tagged by version only.Verified against the registry rather than inferred:
a892a5a6…(v1.14.2 SHA)2834a314…(v1.14.1 SHA)v1.14.2v1.14.1So SHA-pinning this action could never have worked, for any release.
Why the other pins stay
checkout,setup-pythonandupload-artifactremain SHA-pinned. They are JavaScript actions, where the ref selects code and SHA-pinning is exactly right. Only the Docker action turns its ref into an image tag. That distinction is now a comment above the step, since "why is this one different" is the obvious review question.Nothing was published
PyPI's latest is still
3.0.0and3.1.0is absent, so the version number is still free and the release can be re-cut once this lands.