Skip to content

ci: publish all packages from a single pypi job #7294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
u9g wants to merge 1 commit into from
+9 −8
Closed

ci: publish all packages from a single pypi job #7294

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 9 additions & 8 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,31 +210,32 @@ jobs:
package: ${{ matrix.package }}
artifact_name: dist-${{ matrix.package }}

# A single publish job so the pypi environment raises one deployment review
# per release instead of one per package.
publish:
name: Publish ${{ matrix.package }}
name: Publish to PyPI
needs: [discover, build]
if: always() && needs.discover.result == 'success'
runs-on: ubuntu-latest
strategy:
fail-fast: false
max-parallel: 10
matrix:
package: ${{ fromJson(needs.discover.outputs.packages) }}
environment: pypi
permissions:
id-token: write
steps:
- name: Download build artifact
- name: Download build artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
with:
name: dist-${{ matrix.package }}
pattern: dist-*
path: dist/
merge-multiple: true
Comment on lines +227 to +229

@devin-ai-integration devin-ai-integration Bot Sep 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Partial builds produce successful releases

When a package build fails, pattern downloads the remaining artifacts and publishing can succeed. The ignored build failure lets downstream deployment and version bumps proceed after an incomplete release.

Learn more

The build job is a matrix over every discovered package. Its aggregate result becomes failure or cancelled when a package build does not complete, but the publish job runs whenever discovery succeeded. A wildcard artifact download only requires at least one matching artifact and cannot detect which expected package is absent. The publish action can therefore upload the available distributions and return success. The dependent docs, examples, and downstream-bump jobs then treat the incomplete release as complete.

Example: Suppose 78 package builds upload artifacts and livekit-plugins-openai fails before upload. The wildcard downloads the 78 available artifacts, publishes them, and returns success. The workflow bumps downstream repositories even though the new OpenAI package version is absent from PyPI.

Recommended fix: Gate the publish job on needs.build.result == 'success' while retaining always() if needed for explicit result checks. Alternatively, validate the downloaded artifacts against needs.discover.outputs.packages before publishing and fail on every missing package.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.


- name: List distributions
run: ls -la dist/

- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
with:
# A republish must not abort on the packages that already went out.
skip-existing: true

docs:
name: Publish docs
Expand Down