kryten-webqueue 0.23.0__tar.gz → 0.23.1__tar.gz

kryten_webqueue-0.23.1/.github/workflows/python-publish.yml

@@ -0,0 +1,93 @@
+name: Publish Python Package to PyPI
+
+# Builds and publishes to PyPI. This workflow MUST run top-level (never invoked
+# via a reusable `uses:` call). PyPI Trusted Publishing matches the OIDC
+# `job_workflow_ref` claim — the filename of the workflow that contains the
+# running job — against the configured publisher (python-publish.yml). Running
+# this as a reusable workflow would change that filename and break publishing
+# (and is explicitly unsupported by PyPI).
+on:
+  # Primary automated path: fire after "Release Automation" (release.yml)
+  # finishes creating the tag + GitHub Release. workflow_run keeps this workflow
+  # top-level, unlike a reusable `uses:` invocation.
+  workflow_run:
+    workflows: ["Release Automation"]
+    types: [completed]
+  # Manual fallbacks: publishing a GitHub Release by hand, or pushing a tag.
+  release:
+    types: [published]
+  push:
+    tags:
+      - 'kryten-webqueue-v*'
+      - 'v*'
+
+permissions:
+  contents: read
+
+jobs:
+  release-build:
+    name: Build distribution packages
+    runs-on: ubuntu-latest
+    # When triggered by release.yml's completion, only proceed on success.
+    # release/tag triggers aren't workflow_run events, so they always build.
+    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          # For a workflow_run trigger, build the exact commit release.yml
+          # processed; otherwise build the tag/release commit.
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.2.0
+        with:
+          version: "latest"
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Build release distributions
+        run: |
+          uv build
+          echo "📦 Built packages:"
+          ls -lh dist/
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-dists
+          path: dist/
+
+  pypi-publish:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    needs:
+      - release-build
+    environment:
+      name: pypi
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Retrieve release distributions
+        uses: actions/download-artifact@v8
+        with:
+          name: release-dists
+          path: dist/
+
+      - name: Publish release distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/
+          skip-existing: true
+          attestations: false
+
+      - name: Success notification
+        if: success()
+        run: |
+          echo "✅ Successfully published to PyPI!"
+          echo "🔗 Package URL: https://pypi.org/project/kryten-webqueue/"

{kryten_webqueue-0.23.0 → kryten_webqueue-0.23.1}/.github/workflows/release.yml

@@ -1,6 +1,10 @@
 name: Release Automation
 
-# Automatically create GitHub releases when version in pyproject.toml changes
+# Automatically create GitHub releases when version in pyproject.toml changes.
+# Publishing to PyPI is handled separately by python-publish.yml, which triggers
+# on this workflow's completion (see its workflow_run trigger). Publishing is
+# intentionally NOT inlined here: PyPI Trusted Publishing matches the OIDC
+# job_workflow_ref filename, which is configured as python-publish.yml.
 on:
   push:
     branches:
@@ -11,8 +15,6 @@ on:
 
 permissions:
   contents: write
-  pull-requests: read
-  id-token: write
 
 jobs:
   create-release:
@@ -20,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Full history for changelog
       
@@ -93,11 +95,3 @@ jobs:
         if: steps.check_tag.outputs.exists == 'true'
         run: |
           echo "ℹ️ Release ${{ steps.version.outputs.tag }} already exists - skipping"
-
-  publish-to-pypi:
-    name: Publish to PyPI
-    needs: [create-release]
-    uses: ./.github/workflows/python-publish.yml
-    permissions:
-      id-token: write
-      contents: read

{kryten_webqueue-0.23.0 → kryten_webqueue-0.23.1}/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+## [0.23.1] — 2026-06-21
+
+### Changed
+
+- **Release CI hardening (no runtime changes).** PyPI publishing was moved out of a reusable workflow into a top-level one. PyPI Trusted Publishing matches the OIDC `job_workflow_ref` claim — the filename of the workflow containing the running job — against the configured publisher (`python-publish.yml`); invoking that workflow via a reusable `uses:` call is unsupported by PyPI and raised a "workflow misconfiguration" warning. `python-publish.yml` now triggers via `workflow_run` after `release.yml` completes (keeping it top-level so the publisher filename stays `python-publish.yml`), and `release.yml` no longer calls it reusably. All GitHub Actions were bumped off the deprecated Node 20 runtime: `actions/checkout@v7`, `actions/setup-python@v6`, `actions/upload-artifact@v7`, `actions/download-artifact@v8`, and `astral-sh/setup-uv@v8.2.0`.
+
+[0.23.1]: https://github.com/grobertson/kryten-webqueue/releases/tag/v0.23.1
+
 ## [0.23.0] — 2026-06-21
 
 ### Fixed

{kryten_webqueue-0.23.0 → kryten_webqueue-0.23.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kryten-webqueue
-Version: 0.23.0
+Version: 0.23.1
 Summary: Netflix/Tubi-style catalog browser and pay-to-play queue management for CyTube
 Author: grobertson
 License-Expression: MIT

{kryten_webqueue-0.23.0 → kryten_webqueue-0.23.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kryten-webqueue"
-version = "0.23.0"
+version = "0.23.1"
 description = "Netflix/Tubi-style catalog browser and pay-to-play queue management for CyTube"
 readme = "README.md"
 license = "MIT"

kryten_webqueue-0.23.0/.github/workflows/python-publish.yml

@@ -1,75 +0,0 @@
-name: Publish Python Package to PyPI
-
-on:
-  workflow_call:
-  release:
-    types: [published]
-  push:
-    tags:
-      - 'kryten-webqueue-v*'
-      - 'v*'
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  release-build:
-    name: Build distribution packages
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v4
-        with:
-          version: "latest"
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
-      - name: Build release distributions
-        run: |
-          uv build
-          echo "📦 Built packages:"
-          ls -lh dist/
-
-      - name: Upload distributions
-        uses: actions/upload-artifact@v4
-        with:
-          name: release-dists
-          path: dist/
-
-  pypi-publish:
-    name: Publish to PyPI
-    runs-on: ubuntu-latest
-    needs:
-      - release-build
-    environment:
-      name: pypi
-    permissions:
-      id-token: write
-
-    steps:
-      - name: Retrieve release distributions
-        uses: actions/download-artifact@v4
-        with:
-          name: release-dists
-          path: dist/
-
-      - name: Publish release distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          packages-dir: dist/
-          skip-existing: true
-          attestations: false
-
-      - name: Success notification
-        if: success()
-        run: |
-          echo "✅ Successfully published to PyPI!"
-          echo "🔗 Package URL: https://pypi.org/project/kryten-webqueue/"