.github/workflows/release.yml) using
PyPI Trusted Publishing (OIDC) — no long-lived API token is stored.
One-time setup (per project, done once by a maintainer)
- On PyPI, create the
clousight-benchproject (or claim it) and add a Trusted Publisher:- Owner:
clousight - Repository:
clousight-bench - Workflow:
release.yml - Environment:
pypi
- Owner:
- In the GitHub repo settings, create an Environment named
pypi(optionally with required reviewers for a manual approval gate before publish).
Cutting a release
-
Update
CHANGELOG.md: move theUnreleasedsection under the new version with today’s date. -
Bump
versioninpyproject.toml(single source of truth; the release workflow verifies the tag matches it). -
Land those on
mainthrough a pull request. -
Tag and push:
-
The
releaseworkflow builds the sdist + wheel, runstwine check, and publishes to PyPI. Watch the Actions tab. - Create a GitHub Release from the tag and paste the changelog section.
Versioning
Pre-1.0, minor versions may include breaking changes, but the result schema and plugin API carry their own version fields (schema_version,
PLUGIN_API_VERSION) and are migrated deliberately — see CHANGELOG.md and
docs/architecture. Changing the scoring of a shipped dimension always
requires a version bump and a changelog entry.