From 6e31c336c9694a548f270f19335633f53125a2a0 Mon Sep 17 00:00:00 2001
From: shcommit <happysh_s2@naver.com>
Date: Sat, 12 Sep 2026 10:42:42 +0900
Subject: [PATCH] fix(release): switch PyPI publish step to fail-closed (#22)

---
 .github/workflows/release.yml |  1 -
 changelog.md                  |  1 +
 handoff.md                    | 56 ++++++++---------------------------
 improvements.md               |  5 +---
 4 files changed, 15 insertions(+), 48 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 430126b..4f7fc26 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -69,7 +69,6 @@ jobs:
       - name: Publish Python Package to PyPI
         if: ${{ !github.event.repository.private }}
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
-        continue-on-error: true
         with:
           skip-existing: true
 
diff --git a/changelog.md b/changelog.md
index 4be8068..b59360d 100644
--- a/changelog.md
+++ b/changelog.md
@@ -4,6 +4,7 @@ Lightweight human-readable summary of meaningful repository changes.
 
 ## Unreleased
 
+- Switched PyPI publishing in `.github/workflows/release.yml` to fail-closed by removing `continue-on-error: true` (#22).
 - Added scalable GitHub governance: structured Issue Forms, source-controlled
   label taxonomy, path-based PR labels, new-issue triage, weekly grouped
   Dependabot updates targeting `develop`, and a dormant CODEOWNERS draft.
diff --git a/handoff.md b/handoff.md
index ad13a65..938a72e 100644
--- a/handoff.md
+++ b/handoff.md
@@ -2,61 +2,31 @@
 
 ## Current task
 
-Hotfix v1.1.1: closed two gaps discovered while deploying v1.1.0 —
-`.claude-plugin/marketplace.json` missing the `owner` field (blocked
-`claude plugin marketplace add` on Claude Code v2.1.263) and `pyproject.toml`
-not in `scripts/sync_version.py`'s sync surface (v1.1.0 GitHub Release shipped a
-1.0.1 wheel/sdist). Both fixes are landed on `fix/v1.1.1-hotfix`; ready to cut a
-release.
+Resolving GitHub Issue #22 (`Release: PyPI publish를 fail-closed로 전환`). Removed `continue-on-error: true` from `.github/workflows/release.yml` to make PyPI publish failures fail-closed.
 
 ## Touched files
 
-- `.claude-plugin/marketplace.json` — added `$schema`, top-level `description`,
-  `owner.name` (mirrors the working `Agent-toolkit/.claude-plugin/marketplace.json`).
-- `scripts/sync_version.py` — added `TOML_VERSION_SPECS` (`pyproject.toml`
-  `[project]` table), `TOML_VERSION_LINE_RE`, `_section_header_re()`,
-  `sync_toml_version()`. `require_known_paths()` now asserts the `[project]`
-  table is present. `main()` calls `sync_toml_version()`.
-- `tests/unit/test_sync_version.py` — added 6 regression tests for TOML sync
-  (writes, idempotent, check-only, missing-section, other-table-untouched,
-  real-pyproject-drift guard).
-- `skills/adr-toolkit/VERSION`, `SKILL.md` frontmatter, `.claude-plugin/plugin.json`,
-  `adapters/gemini-cli/gemini-extension.json`, `adapters/antigravity/plugin.json`,
-  `pyproject.toml` — all synced to 1.1.1 via `scripts/sync_version.py`.
-- `changelog.md` — new `## v1.1.1 (2026-09-06)` section.
+- `.github/workflows/release.yml` — removed `continue-on-error: true` from `Publish Python Package to PyPI` step.
+- `improvements.md` — moved `PyPI publish fail-closed 재검토` from Open to Done.
+- `changelog.md` — added note under `## Unreleased`.
 - `handoff.md` — this file.
 
-## Verification (local, Python 3.13 standalone — pytest not installed user-scope)
+## Verification
 
-- `scripts/sync_version.py --check`: **exit 0** (no drift, including pyproject.toml).
-- 6 new TOML sync tests re-run as standalone assertions: **all pass**.
-- `script/sync_version.py` and `tests/unit/test_sync_version.py` parse with
-  `ast.parse`: OK.
-- Real-repo guard: `pyproject.toml` `[project] version` reports `1.1.1`, matches
-  `skills/adr-toolkit/VERSION`.
+- `scripts/sync_version.py --check`: **exit 0**
+- `.github/workflows/release.yml` YAML syntax validated via `yaml.safe_load`: **exit 0**
+- `git status` / `git diff` clean and verified.
 
 ## Next step
 
-1. Merge `fix/v1.1.1-hotfix` → `develop` (PR, CI must pass — including the
-   version-drift job, which now also checks pyproject.toml).
-2. Open `release/v1.1.1` → `master` PR; after CI passes (release.yml runs the
-   full suite + tag == VERSION check), merge.
-3. Back-merge `master` → `develop`.
-4. Tag `v1.1.1` from `master` and push — `release.yml` runs pytest +
-   sync_version --check + tag == VERSION, then publishes a GitHub Release with
-   the skill tarball + sha256 + Python wheel/sdist, and publishes to PyPI via
-   Trusted Publisher (`continue-on-error: true`, tracked in improvements.md).
-5. After release, refresh the local installs on the four harnesses
-   (Claude Code `~/.claude/skills/` symlink, Codex `~/.codex/skills/`,
-   Antigravity `~/.gemini/config/plugins/adr-toolkit/skills/adr-toolkit/`,
-   Cline `~/.agents/skills/`) to v1.1.1 — the same flow used to bring them to
-   v1.1.0 in the previous session.
+1. Commit changes to `fix/issue-22-pypi-fail-closed` branch and push to origin (or PR into `develop`).
+2. Close Issue #22 on GitHub (`gh issue close 22 --comment "Fixed via fail-closed release workflow update"`).
+3. Proceed to next issue (e.g. Issue #30 PyPA license metadata modernization).
 
 ## Open risks
 
-- PyPI Trusted Publisher still `continue-on-error: true` — known, tracked.
-- Cline adapter still manually verified; `harness-parity` not covering Cline yet
-  (Medium backlog item from PR #36).
+- PyPI publishing failure will now block release workflow completely (intended fail-closed behavior; requires PyPI Trusted Publisher credentials to be fully valid).
+- Cline adapter still manually verified; `harness-parity` not covering Cline yet.
 - Inherits prior Open risks (ruleset context sync, deferred automation).
 
 ## PR #43 pr-title-check stale re-trigger
diff --git a/improvements.md b/improvements.md
index a2111e6..8288a0d 100644
--- a/improvements.md
+++ b/improvements.md
@@ -65,11 +65,8 @@ Backlog derived from `docs/adr-toolkit-audit-report.md`, operational experiences
 - [ ] *(전제조건: 저장소 2개 이상)* **조직 단위 ruleset/reusable workflow/audit export/taxonomy** — 여러 저장소가 같은 운영 문제를 반복할 때 설계 시작. 지금은 저장소가 1개뿐이라 시작 조건 미충족. (enterprise-adoption.md §6, §8 항목 5)
 - [ ] *(다음 governance PR merge 직후)* **required-check context 동기화** — ruleset `22101891`에서 Python 3.9 context를 제거하고 Python 3.10 matrix, `lint`, `dependency-audit`를 required로 추가한 뒤 effective-rules API로 재검증한다.
 - [ ] *(동일 drift 재발 시)* **ruleset 설정 검증 자동화** — classic branch-protection API와 repository ruleset API를 혼동한 감사 오류 및 CI check-name drift가 다시 발생하면 ruleset-as-code 또는 read-only verification script를 도입한다.
-- [ ] **PyPI publish fail-closed 재검토** — Trusted Publisher가 안정화되면 release workflow의 `continue-on-error: true`를 제거해 GitHub Release와 PyPI가 부분 성공으로 갈라지지 않게 한다.
 - [ ] **PyPA license metadata 현대화** — 2027-02-18 이전에 deprecated `project.license` table과 license classifier를 SPDX expression / `license-files`로 전환하고 최소 setuptools 버전을 맞춘다.
 
 ## Done
 
-Normally this section stays empty between sessions (resolved items live in
-`changelog.md` + git history instead, and this session's own architectural
-decisions in `docs/decisions/ADR-0012..0016`).
+- [x] **PyPI publish fail-closed 재검토** — Trusted Publisher가 안정화되어 release workflow의 `continue-on-error: true`를 제거하고 fail-closed로 전환 완료 (#22).