chore: publish cross-platform PyPI wheels via maturin-action - #174
Francisco Jiménez (jjcfrancisco) wants to merge 6 commits into
Conversation
Francisco Jiménez (jjcfrancisco)
changed the title
Co-authored-by: John McCall <16843041+lowlydba@users.noreply.github.com> Signed-off-by: Francisco Jiménez <49205177+jjcfrancisco@users.noreply.github.com>
Co-authored-by: John McCall <16843041+lowlydba@users.noreply.github.com> Signed-off-by: Francisco Jiménez <49205177+jjcfrancisco@users.noreply.github.com>
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Critical release workflow issues and incorrect README API examples remain unresolved.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 2
Open (4)
What changed in this PR
Adds tag-triggered cross-platform PyPI wheel/sdist publishing via maturin and OIDC, plus migration guidance for the legacy Python API.
Changes:
- Builds Linux, macOS, and Windows wheels.
- Publishes wheels and an sdist to PyPI.
- Documents migration from version 1.4.0.
| File | Summary | Findings |
|---|---|---|
.github/workflows/publish-pypi.yaml |
Cross-platform build and PyPI publishing workflow | Critical: tag version is not applied; third-party actions are not pinned to immutable SHAs. |
README.md |
Migration guidance for 1.4.0 users | Moderate: incorrect build_catalog API and unqualified validate_catalog; nit: grammatical error. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| args: --release --out dist --features python,extension-module | ||
| manylinux: ${{ matrix.target.manylinux }} |
There was a problem hiding this comment.
Confirmed independently: Cargo.toml was already at version = "0.1.0" when the v2.0.0 tag was cut (git show v2.0.0:Cargo.toml), so this predates this PR and would bite the very first tag-driven publish. +1 on extracting the version from GITHUB_REF_NAME and applying it before both maturin invocations, since the CLI/crate share this same version field with the wheel — a tag-driven override keeps all three release artifacts in sync from one source.
There was a problem hiding this comment.
note: the broader picture for why this matters past just this tag — the repo is moving to three release channels that all share this one Cargo.toml version field: the CLI binary (source-build only today, per the README's migration note), the PyPI wheel (this PR, tag-triggered), and the crates.io crate (not published yet, no workflow exists for it). This PR is the first automation that actually consumes a v* tag, so it's also the first time the pre-existing Cargo.toml/tag drift turns into a real publish bug instead of a dormant one.
Whichever fix lands here, tag-driven version injection or a mismatch guard, is worth reusing verbatim once the crates.io workflow gets added, rather than inventing a second version-detection path there. cargo publish reads the same Cargo.toml field the wheel build does, so a fix scoped only to the maturin steps leaves that future workflow exposed to the identical bug.
There was a problem hiding this comment.
John McCall (@lowlydba) I fixed it in e1daada
Updated README to reflect changes in overture-stac 2.x, including CLI installation and API modifications. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Francisco Jiménez <49205177+jjcfrancisco@users.noreply.github.com>
The old publish-pypi.yml was dropped in the Rust port, so PyPI still serves the pre-rewrite 1.4.0. This adds a workflow that builds wheels for Linux, macOS, and Windows via PyO3/maturin-action and publishes them plus an sdist in one OIDC step on v* tag pushes. README also picks up a short migration note pointing 1.4.0 users at the new CLI and module functions.
Closes #144.