chore: PyPI release prep (v0.1.0) - #8
Conversation
- README: replace the now-false 'nothing equivalent' claim with honest positioning against existing MCP scanners; absolutize all relative links/images so the PyPI project page renders them - pyproject: explicit sdist allowlist (hatchling's default packs untracked local files) - release.yml: build + twine check + publish via PyPI trusted publishing (OIDC, no token) on v* tags Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR adds a new GitHub Actions release workflow that builds, validates, and publishes packages to PyPI on version tag pushes, updates pyproject.toml with a Hatchling sdist packaging allowlist, and converts relative README links/images to absolute GitHub URLs. ChangesRelease Workflow and Packaging
README Link Updates
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant GitHub as GitHub Tag Push
participant BuildJob as build job
participant PublishJob as publish job
participant PyPI
GitHub->>BuildJob: trigger on v* tag push
BuildJob->>BuildJob: python -m build, twine check
BuildJob->>PublishJob: upload dist artifact
PublishJob->>PublishJob: download dist artifact
PublishJob->>PyPI: publish via OIDC trusted publishing
Related Issues: None specified. Related PRs: None specified. Suggested labels: ci, documentation, packaging Suggested reviewers: Mhemd139 Poem A tag is pushed, a rabbit hops, 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 3-9: The workflow lacks an explicit least-privilege permissions
block, so the `build` job is using default `GITHUB_TOKEN` scopes instead of only
what checkout/build needs. Add a workflow-level or `build` job-level
`permissions` section in the release workflow, keeping it minimal and aligned
with the existing `publish` job’s approach, and ensure the `build` and `publish`
jobs each request only the specific scopes they require.
- Line 11: Update the checkout step in the release workflow to disable
credential persistence by setting persist-credentials to false on the
actions/checkout usage. This is a workflow-only change in the build job, and the
relevant symbol to locate is the checkout step in the release workflow; no other
git or artifact steps should need changes.
In `@README.md`:
- Line 7: The license badge/footer links in README are pointing to the
repository tree view instead of the file-view URL, which makes the destination
misleading or broken. Update the existing MIT license link(s) in README so they
use the file-content/blob form for the LICENSE target, and make the same change
wherever the license footer/link is repeated, using the badge/link markup
already present.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7dff937e-11c4-4f6c-a7d7-84af48eaa7e6
📒 Files selected for processing (3)
.github/workflows/release.ymlREADME.mdpyproject.toml
| on: | ||
| push: | ||
| tags: ["v*"] | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Add an explicit least-privilege permissions block.
No permissions: key is set at the workflow or build job level, so GITHUB_TOKEN receives the repository's default permissions rather than the minimum needed for checkout/build/twine-check. The publish job already does this correctly (id-token: write only).
🔒 Suggested fix
on:
push:
tags: ["v*"]
+
+permissions:
+ contents: readFlagged by static analysis (zizmor excessive-permissions).
Also applies to: 8-21
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 3 - 9, The workflow lacks an
explicit least-privilege permissions block, so the `build` job is using default
`GITHUB_TOKEN` scopes instead of only what checkout/build needs. Add a
workflow-level or `build` job-level `permissions` section in the release
workflow, keeping it minimal and aligned with the existing `publish` job’s
approach, and ensure the `build` and `publish` jobs each request only the
specific scopes they require.
Source: Linters/SAST tools
| build: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Set persist-credentials: false on checkout.
The build job checks out the repo and later uploads dist/ as an artifact; the checkout action persists the GITHUB_TOKEN credential on disk by default, which is unnecessary here since no further git operations are performed.
🔒 Suggested fix
- uses: actions/checkout@v4
+ with:
+ persist-credentials: falseFlagged by static analysis (zizmor artipacked).
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v4 | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 11-11: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 11, Update the checkout step in the
release workflow to disable credential persistence by setting
persist-credentials to false on the actions/checkout usage. This is a
workflow-only change in the build job, and the relevant symbol to locate is the
checkout step in the release workflow; no other git or artifact steps should
need changes.
Source: Linters/SAST tools
| [](https://github.com/Mhemd139/Covenant/actions/workflows/ci.yml) | ||
|  | ||
| [](LICENSE) | ||
| [](https://github.com/Mhemd139/Covenant/tree/main/LICENSE) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Use the file-view URL for the license links.
LICENSE is a file, but these targets use the tree form. GitHub’s file-content links use the blob/file-view form, so this is likely a broken or misleading destination for the badge/footer links. (docs.github.com)
Proposed fix
-[](https://github.com/Mhemd139/Covenant/tree/main/LICENSE)
+[](https://github.com/Mhemd139/Covenant/blob/main/LICENSE)
-[MIT](https://github.com/Mhemd139/Covenant/tree/main/LICENSE)
+[MIT](https://github.com/Mhemd139/Covenant/blob/main/LICENSE)Also applies to: 159-159
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 7, The license badge/footer links in README are pointing
to the repository tree view instead of the file-view URL, which makes the
destination misleading or broken. Update the existing MIT license link(s) in
README so they use the file-content/blob form for the LICENSE target, and make
the same change wherever the license footer/link is repeated, using the
badge/link markup already present.
1 participant
Prepares the repo to publish
covenant-mcpto PyPI via trusted publishing.Changes
covenant/,tests/,examples/, the two config files, README and LICENSE; wheel contains only the package.v*tag — build,twine check, publish to PyPI via OIDC trusted publishing (environmentpypi, no API token). Both artifacts passtwine checklocally.After merge
covenant-mcp, ownerMhemd139, repoCovenant, workflowrelease.yml, environmentpypiv0.1.0on main → workflow publishes →pip install covenant-mcp🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation
Chores