pineforge-codegen 0.7.5__tar.gz → 0.7.6__tar.gz

{pineforge_codegen-0.7.5 → pineforge_codegen-0.7.6}/.github/workflows/release.yml

@@ -40,12 +40,24 @@ jobs:
       OVERRIDE:      ${{ inputs.override }}
       PYTHONHASHSEED: "0"   # deterministic gate runtime (match gate.yml)
     steps:
+      # Org GitHub App token (no PAT — never expires). Authorizes BOTH the
+      # release commit/tag push to protected main (the App is a bypass actor on
+      # the org ruleset) AND the downstream hub dispatch. Scoped to this repo +
+      # the hub. Minted first so checkout can push with it.
+      - name: Mint org App token
+        id: app
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.PINEFORGE_APP_ID }}
+          private-key: ${{ secrets.PINEFORGE_APP_PRIVATE_KEY }}
+          owner: pineforge-4pass
+          repositories: pineforge-codegen-oss,pineforge-release
+
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           fetch-depth: 0
-          # PAT (RELEASE_PAT) needed if a branch ruleset on `main` blocks
-          # GITHUB_TOKEN pushes. Falls back to GITHUB_TOKEN if unset.
-          token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
+          # App token bypasses the main ruleset for the release commit/tag push.
+          token: ${{ steps.app.outputs.token }}
 
       - name: Compute new version
         id: ver
@@ -132,8 +144,8 @@ jobs:
       - name: Create GitHub Release
         if: ${{ !inputs.dry_run }}
         env:
-          # Org disables write for the default Actions token; use the admin PAT.
-          GH_TOKEN:    ${{ secrets.RELEASE_PAT }}
+          # Org disables write for the default Actions token; use the App token.
+          GH_TOKEN:    ${{ steps.app.outputs.token }}
           NEW_VERSION: ${{ steps.ver.outputs.new }}
         run: |
           gh release create "v${NEW_VERSION}" \
@@ -141,3 +153,22 @@ jobs:
             --generate-notes \
             --notes "Install: \`pip install pineforge-codegen==${NEW_VERSION}\`" \
             dist/*
+
+      # Notify the pineforge-release hub: it bumps its CODEGEN_VERSION pin,
+      # rebuilds the combined image, and fans out to the MCPs. FAIL LOUD (no
+      # continue-on-error) — a dropped notify means downstream never picks up the
+      # new codegen. Uses the App token minted above (no PAT). Runs AFTER the
+      # PyPI publish so the version is installable.
+      - name: Dispatch codegen-release -> pineforge-release
+        if: ${{ !inputs.dry_run }}
+        env:
+          GH_TOKEN:    ${{ steps.app.outputs.token }}
+          NEW_VERSION: ${{ steps.ver.outputs.new }}
+          RUN_ID:      ${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          gh api repos/pineforge-4pass/pineforge-release/dispatches \
+            -f event_type=codegen-release \
+            -F "client_payload[version]=${NEW_VERSION}" \
+            -F "client_payload[run_id]=${RUN_ID}"
+          echo "dispatched codegen-release -> pineforge-release (${NEW_VERSION})"

{pineforge_codegen-0.7.5 → pineforge_codegen-0.7.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pineforge-codegen
-Version: 0.7.5
+Version: 0.7.6
 Summary: PineScript v6 to C++ transpiler that targets the pineforge-engine runtime.
 Project-URL: Homepage, https://github.com/pineforge-4pass/pineforge-codegen-oss
 Project-URL: Issues, https://github.com/pineforge-4pass/pineforge-codegen-oss/issues

pineforge_codegen-0.7.6/VERSION

@@ -0,0 +1 @@
+0.7.6

pineforge_codegen-0.7.5/VERSION

@@ -1 +0,0 @@
-0.7.5