Skip to content

Publish to PyPI on tags; fix remaining CI failures - #222

Merged
lordjabez merged 15 commits into
masterfrom
ci-publish
Oct 1, 2026
Merged

lordjabez merged 15 commits into
masterfrom
ci-publish

Conversation

@lordjabez

Copy link
Copy Markdown
Collaborator

Adds a tag-triggered PyPI publish workflow and fixes the CI failures left over from #221.

Publish workflow (.github/workflows/publish.yml)

  • Triggered by pushing a vX.Y.Z tag (rc/a/b suffixes allowed).
  • The build job runs with read-only permissions. It fails if the tag doesn't match pyproject.toml's version, then builds and smoke-tests the wheel and sdist (import plus Session().close()), and uploads them as an artifact.
  • The publish job only has id-token: write and runs in the pypi environment. It generates PEP 740 attestations and runs uv publish with Trusted Publishing, so no PyPI token is stored anywhere.
  • This follows uv's recommended two-job layout and the repo's existing conventions (harden-runner, SHA-pinned actions).

One-time setup before the first run:

  1. GitHub: Settings → Environments → create pypi. Adding yourself as a required reviewer is optional.
  2. PyPI: requestium → Publishing → add a GitHub Trusted Publisher with owner tryolabs, repo requestium, workflow publish.yml, environment pypi.

CI fixes

  • test_proxy_flag_reaches_chrome hit the same Chrome 152 HTTPS-First blank-page problem as the other proxied tests. It now uses a shared DISABLE_HTTPS_UPGRADES constant.
  • Fixed the 5 CodeQL alerts in test code: exact URL comparisons instead of startswith, and TLS 1.2+ on the test HTTPS listener.
  • The macOS 3.11 lowest-direct failure in Fix driver lifecycle and cookie bugs, update deps, offline test suite (0.6.0) #221 was a mid-run Chrome auto-update ("ChromeDriver only supports Chrome version 152"), not a code issue.

🤖 Generated with Claude Code

https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a

lordjabez and others added 15 commits October 1, 2026 11:30
- Add explicit setuptools build-system and PEP 639 license metadata
- Move dev tools to a PEP 735 dependency group instead of a published extra
- Bump ruff, bandit, ssort, pre-commit; refresh uv.lock
- Point the bandit pre-commit hook at requestium/ (it matched nothing)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
- try_add_cookie only suppresses cookie-rejection errors; others propagate
  with their message instead of a bare WebDriverException
- ensure_add_cookie no longer mutates the caller's dict
- Navigate over https for secure cookies (#97)
- Replace substring domain match with an exact/subdomain check
- Honor an explicit timeout=0 in ensure_element
- RequestiumResponse copies the wrapped response's state instead of
  building a new class per response

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
…to Chrome

- Session.close() (and leaving a with block) quits the driver (#177)
- Give user-supplied drivers the DriverMixin helpers by swapping in a cached
  subclass; the old per-function patching skipped the selector property, so
  xpath/css/re failed on injected drivers including webdriver.Remote (#31)
- Wrap every HTTP verb via request() instead of only get/post/put
- Pass session proxies and a custom User-Agent to Requestium's own Chrome
  at launch; credentialed proxies are skipped with a warning (#96, #55, #37)
- Carry secure/path/expiry when transferring cookies in both directions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
Fix examples that didn't match the API (keyword-only Session, missing
comma, JS booleans), note Selenium Manager, and document close/context
manager, Remote drivers, proxy/User-Agent carry-over, and https for
secure cookies.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
- Local HTTP server and forward proxy fixture so cookie tests no longer
  hit google.com/example.com
- New tests for ensure_element states and timeouts, ensure_click DOM
  effects, driver-side parsing, and a Remote driver backed by a local
  chromedriver service (#31)
- Collapse duplicated ensure_element_by_* and session init tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
Ruff 0.16 formats Python code fences in Markdown, so pre-commit
rewrites these.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
Replace four ad-hoc HTTP servers with a single conftest LocalServer
(forward proxy, request log, optional TLS listener), merge the
agent-split cookie and session test files into functional modules
(add_cookie, cookies, session, proxy, user_agent), and drop duplicate
tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
Chrome tries http:// navigations over https first. With balanced
HTTPS-First mode auto-enabled (e.g. Chrome 152 on CI runners) it does
not fall back to http when the CONNECT through the test proxy fails,
so every proxied page came up blank and cookie tests failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
Dependabot bumped init/analyze but left autobuild and upload-sarif on
v4.31.10, and CodeQL refuses to run with mismatched versions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
- Apply the HTTPS-upgrade workaround to the Requestium-launched Chrome in
  the proxy test, via a shared DISABLE_HTTPS_UPGRADES constant
- Compare exact URLs instead of startswith (CodeQL incomplete URL
  substring sanitization)
- Require TLS 1.2+ on the test HTTPS listener (CodeQL insecure TLS)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
Build and smoke-test in an unprivileged job, then publish with PyPI
Trusted Publishing and PEP 740 attestations from a separate job that
only holds id-token: write, gated by the pypi environment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01446x2ZH4bs3pKQ6mV84K1a
@lordjabez
lordjabez merged commit 584e054 into master Oct 1, 2026
34 of 40 checks passed
@lordjabez lordjabez mentioned this pull request Oct 1, 2026
@lordjabez
lordjabez deleted the ci-publish branch October 2, 2026 16:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant