fix(release): apply PSR v10.5.3 bug mitigations to reusable workflow#184
Conversation
PSR v10.5.3 has two bugs affecting the no-PyPI release pattern: 1. 422 on GitHub Release creation: github3 library serializes draft/prerelease as JSON strings rather than booleans. Fix: vcs_release: "false" + separate gh release create step that types booleans correctly. 2. Detached HEAD prevents branch matching: actions/checkout with ref: <sha> leaves HEAD detached; PSR needs an attached branch to match branches config. Fix: git checkout -B "$HEAD_BRANCH" after checkout. Also adds: - Fork verification step for workflow_run callers (S7631) - SHA-pinned checkout (ref: workflow_run.head_sha || github.sha) - commit: "false" so PSR only pushes tags (branch rulesets exempt tag refs) - publish-to-pypi default changed from true to false Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 37 minutes and 45 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
1 participant
Summary
vcs_release: "false"+ separategh release create dist/*step — avoids thegithub3boolean serialization bug that returns 422 from GitHub Releases APIgit checkout -B "$HEAD_BRANCH"step forworkflow_runcallers — PSR requires an attached branch to match[tool.semantic_release.branches]configcommit: "false"so PSR only pushes tags; tag refs are exempt from branch rulesets, no bypass actor neededworkflow_runcallerspublish-to-pypidefault flipped fromtruetofalse— callers must now opt in explicitlyValidated against
End-to-end validation on
ByronWilliamsCPA/.claude(release v0.14.0, 2026-05-28). All five mitigations confirmed working.Test plan
python-release.ymlis updated on maingh release createGenerated with Claude Code