fix(ci): gate publish on validation + fix export-ci-env manifest cras… #320
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # wads CI — calls the reusable workflow hosted in i2mint/wads. | |
| # | |
| # All configuration comes from this repo's pyproject.toml [tool.wads.ci.*]. | |
| # To customize the workflow itself (rare), replace this file with the | |
| # full inline template `wads/data/github_ci_uv.yml` from i2mint/wads. | |
| # | |
| # Pinning: `@master` floats with wads. If you need version stability for | |
| # a release-sensitive repo, change `@master` to a wads tag (e.g. `@v0.1.81`). | |
| # CI failure does not block a published release — it blocks the publish | |
| # step itself — so floating master is generally safe. | |
| # | |
| # Permissions: GitHub validates that the caller grants AT LEAST the | |
| # permissions any job in the called workflow requests — at workflow-parse | |
| # time, not at run-time, even if the job would be skipped via `if:`. | |
| # The reusable workflow needs: | |
| # contents: write for the publish job's version-bump push-back | |
| # pages: write for the github-pages publish (if enabled) | |
| # id-token: write for the github-pages OIDC handshake (if enabled) | |
| # Granting these in the stub keeps it working on any caller, including | |
| # personal-account repos where id-token is not write-by-default. | |
| name: Continuous Integration | |
| on: [push, pull_request] | |
| jobs: | |
| ci: | |
| uses: i2mint/wads/.github/workflows/uv-ci.yml@master | |
| permissions: | |
| contents: write | |
| pages: write | |
| id-token: write | |
| # Explicit pass-through (not `secrets: inherit`) because `inherit` does | |
| # not reliably propagate caller-repo secrets to a reusable workflow | |
| # owned by a different account (verified empirically: caller in a | |
| # personal account, called in i2mint org → `${{ secrets.PYPI_PASSWORD }}` | |
| # resolved to empty inside the reusable workflow despite the secret | |
| # being set on the caller repo). Listing each secret here makes the | |
| # propagation unambiguous regardless of caller-vs-called ownership. | |
| # Missing secrets on the caller resolve to empty strings, harmless for | |
| # the optional ones; PYPI_PASSWORD must be set for the publish job. | |
| secrets: | |
| PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }} | |
| OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} | |
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | |
| HF_TOKEN: ${{ secrets.HF_TOKEN }} | |
| HUGGINGFACE_TOKEN: ${{ secrets.HUGGINGFACE_TOKEN }} | |
| KAGGLE_USERNAME: ${{ secrets.KAGGLE_USERNAME }} | |
| KAGGLE_KEY: ${{ secrets.KAGGLE_KEY }} |