fix: stabilize release and provider CI

Author: pirate

.github/workflows/publish.yml

@@ -36,4 +36,5 @@ jobs:
         env:
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
           GH_TOKEN: ${{ github.token }}
+          PYPI_PAT_SECRET: ${{ secrets.PYPI_PAT_SECRET }}
         run: ./bin/release.sh

.github/workflows/release.yml

@@ -44,6 +44,8 @@ jobs:
   build:
     needs: precheck
     runs-on: ${{ matrix.os }}
+    env:
+      PNPM_HOME: ${{ runner.temp }}/pnpm
     strategy:
       fail-fast: true
       matrix:
@@ -64,6 +66,16 @@ jobs:
         enable-cache: true
         cache-dependency-glob: "uv.lock"
 
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v4
+      with:
+        version: 10
+
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+
     - name: Install Nix on macOS
       if: runner.os == 'macOS'
       uses: DeterminateSystems/nix-installer-action@v16
@@ -73,16 +85,21 @@ jobs:
         uv venv --python "${{ matrix.python_version }}" \
         && uv sync --all-extras \
         && uv pip install pip \
+        && mkdir -p "$PNPM_HOME" \
+        && echo "$PNPM_HOME" >> "$GITHUB_PATH" \
         && echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH" \
         && if [ -d /nix/var/nix/profiles/default/bin ]; then echo "/nix/var/nix/profiles/default/bin" >> "$GITHUB_PATH"; fi
 
     - name: Run standard test suite
       run: |
         source .venv/bin/activate \
+        && export PATH="$PNPM_HOME:$PATH" \
         && python tests.py
 
   live-integration:
     runs-on: ${{ matrix.os }}
+    env:
+      PNPM_HOME: ${{ runner.temp }}/pnpm
     strategy:
       fail-fast: true
       matrix:
@@ -102,6 +119,16 @@ jobs:
         enable-cache: true
         cache-dependency-glob: "uv.lock"
 
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v4
+      with:
+        version: 10
+
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+
     - name: Install Nix
       uses: DeterminateSystems/nix-installer-action@v16
 
@@ -121,6 +148,8 @@ jobs:
         uv venv --python "3.12" \
         && uv sync --all-extras \
         && uv pip install pip \
+        && mkdir -p "$PNPM_HOME" \
+        && echo "$PNPM_HOME" >> "$GITHUB_PATH" \
         && echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH" \
         && echo "/nix/var/nix/profiles/default/bin" >> "$GITHUB_PATH"
 
@@ -134,6 +163,7 @@ jobs:
       if: runner.os == 'macOS'
       run: |
         source .venv/bin/activate \
+        && export PATH="$PNPM_HOME:$PATH" \
         && python -m unittest \
           tests.LiveUpdateAndUninstallTest.test_brew_provider_live_update_and_uninstall \
           tests.LiveUpdateAndUninstallTest.test_pip_provider_live_update_and_uninstall \
@@ -148,6 +178,7 @@ jobs:
       if: runner.os == 'Linux'
       run: |
         source .venv/bin/activate \
+        && export PATH="$PNPM_HOME:$PATH" \
         && python -m unittest \
           tests.LiveUpdateAndUninstallTest.test_pip_provider_live_update_and_uninstall \
           tests.LiveUpdateAndUninstallTest.test_npm_provider_live_update_and_uninstall \
@@ -160,7 +191,7 @@ jobs:
     - name: Run root-required live package lifecycle tests on Linux
       if: runner.os == 'Linux'
       run: |
-        sudo env "PATH=$PATH:/nix/var/nix/profiles/default/bin" ./.venv/bin/python -m unittest \
+        sudo env "PATH=$PNPM_HOME:$PATH:/nix/var/nix/profiles/default/bin" ./.venv/bin/python -m unittest \
           tests.LiveUpdateAndUninstallTest.test_apt_provider_live_update_and_uninstall \
           tests.LiveUpdateAndUninstallTest.test_pyinfra_provider_live_update_and_uninstall \
           tests.LiveUpdateAndUninstallTest.test_ansible_provider_live_update_and_uninstall

.github/workflows/tests.yml

@@ -188,6 +188,7 @@ def _npm(
         bootstrap_pnpm: bool = False,
     ) -> subprocess.CompletedProcess:
         global _CACHED_GLOBAL_NPM_PREFIX
+        env = os.environ.copy()
 
         npm_abspath = self.INSTALLER_BIN_ABSPATH
         if not npm_abspath:
@@ -221,6 +222,19 @@ def _npm(
         subcommand, *npm_args = npm_cmd
         cmd = npm_cmd
         if Path(npm_abspath).name == "pnpm":
+            pnpm_home = Path(
+                env.get("PNPM_HOME")
+                or (
+                    self.npm_prefix / "node_modules/.bin"
+                    if self.npm_prefix
+                    else self.cache_dir / "pnpm-home"
+                ),
+            )
+            pnpm_home.mkdir(parents=True, exist_ok=True)
+            env["PNPM_HOME"] = str(pnpm_home)
+            path_entries = [entry for entry in env.get("PATH", "").split(":") if entry]
+            if str(pnpm_home) not in path_entries:
+                env["PATH"] = ":".join([str(pnpm_home), *path_entries])
             cmd = [
                 {
                     "install": "add",
@@ -244,6 +258,7 @@ def _npm(
             cmd=cmd,
             quiet=quiet,
             timeout=timeout,
+            env=env,
         )
 
     def setup(self) -> None:

abx_pkg/binprovider_npm.py

@@ -231,6 +231,22 @@ create_release() {
         --generate-notes
 }
 
+publish_artifacts() {
+    local version="$1"
+    local pypi_token="${UV_PUBLISH_TOKEN:-${PYPI_TOKEN:-${PYPI_PAT_SECRET:-}}}"
+
+    if [[ -n "${pypi_token}" ]]; then
+        UV_PUBLISH_TOKEN="${pypi_token}" uv publish --username=__token__ dist/*
+    elif [[ -n "${GITHUB_ACTIONS:-}" ]]; then
+        uv publish --trusted-publishing always dist/*
+    else
+        echo "Missing PyPI credentials: set UV_PUBLISH_TOKEN or PYPI_TOKEN" >&2
+        return 1
+    fi
+
+    wait_for_pypi "${PYPI_PACKAGE}" "${version}"
+}
+
 main() {
     local slug branch version latest relation
 
@@ -257,9 +273,8 @@ main() {
 
     wait_for_runs "${slug}" push "$(git rev-parse HEAD)" "push"
 
+    publish_artifacts "${version}"
     create_release "${slug}" "${version}"
-    wait_for_runs "${slug}" release "$(git rev-parse HEAD)" "release"
-    wait_for_pypi "${PYPI_PACKAGE}" "${version}"
 
     latest="$(latest_release_version "${slug}")"
     relation="$(compare_versions "${latest}" "${version}")"

bin/release.sh

@@ -1,6 +1,6 @@
 [project]
 name = "abx-pkg"
-version = "1.9.17"
+version = "1.9.18"
 description = "System package manager interfaces with Python type hints"
 authors = [{name = "Nick Sweeting"}, {name = "ArchiveBox"}]
 requires-python = ">=3.11"

pyproject.toml

@@ -1608,7 +1608,7 @@ def test_npm_provider_respects_absolute_env_override_over_pnpm(
         BinProvider,
         "INSTALLER_BIN_ABSPATH",
         new_callable=mock.PropertyMock,
-        return_value=Path("/usr/local/bin/pip"),
+        return_value=Path(sys.executable),
     )
     @mock.patch(
         "abx_pkg.binprovider_pip.PipProvider.load_PATH_from_pip_sitepackages",
@@ -1679,7 +1679,7 @@ def fake_venv_create(path, **kwargs):
         BinProvider,
         "INSTALLER_BIN_ABSPATH",
         new_callable=mock.PropertyMock,
-        return_value=Path("/usr/local/bin/pip"),
+        return_value=Path(sys.executable),
     )
     @mock.patch(
         "abx_pkg.binprovider_pip.PipProvider.load_PATH_from_pip_sitepackages",
@@ -1742,7 +1742,7 @@ def test_pip_provider_update_uses_install_upgrade(
         BinProvider,
         "INSTALLER_BIN_ABSPATH",
         new_callable=mock.PropertyMock,
-        return_value=Path("/usr/local/bin/pip"),
+        return_value=Path(sys.executable),
     )
     @mock.patch(
         "abx_pkg.binprovider_pip.PipProvider.load_PATH_from_pip_sitepackages",