Repository navigation
[DEVOPS-12319] Only publish to PyPI and GHCR after a successful build - #2099
Merged
Merged
Conversation
When build is skipped or fails, test-build is skipped too, and the 'success or skipped' check let pypi-publish and container-publish run anyway. Since #2098, build is skipped whenever check-draft-release fails, so a run against an already-published release would still have pushed the container image to ghcr.io (:latest and :<tag>). Found in a dry run of the release flow in a fork. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
abacchilb
requested review from
Gabefire,
KahvehS,
gramos-lb,
john-labelbox,
labelbox-engineering,
manuaero and
ramy1951
November 3, 2026 14:33
Gabefire
approved these changes
Nov 3, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to #2098, found while dry-running the new release flow in a fork. Jira: DEVOPS-12319.
Bug
pypi-publishandcontainer-publishrun whentest-buildsucceeded or was skipped. Whenbuildis skipped or fails,test-buildis skipped too, so both jobs still run.Since #2098,
buildis skipped whenevercheck-draft-releasefails, for example when a maintainer publishes the release by hand instead of leaving it a draft. In that case:pypi-publishfails harmlessly, because there is no build artifact to download.container-publishdoes not need the build artifact. It rebuilds the image from the tag and pushesghcr.io/labelbox/labelbox-python:latestand:<tag>, even though the run failed its release check.The same was already true before #2098 whenever
builditself failed.Fix
Both jobs now also require
needs.build.result == 'success'.Testing
Dry run in a fork (
abacchilb/labelbox-python, temporary; it will be deleted) with Immutable Releases on, the PyPI upload replaced by a no-op and the container jobs removed:check-draft-releaseas intended, butpypi-publishstill ran.check-draft-release.multiple.intoto.jsonl.Type of change
🤖 Generated with Claude Code