S3.4 — CI and publishing: current actions, Trusted Publishing, Dependabot

#task #oxmpl #oxmpl/epic #oxmpl/story/size-M #oxmpl/sprint/002

Intent

Remove the drift that built up over a year of pinned and 'latest' versions, retire Node-20 actions, move every registry to tokenless Trusted Publishing, and remove the sed/sleep crate-publish path that failed in 0.7.0.

Acceptance criteria

Revisit before starting (noted 2026-10-09)

The pypi.yml criterion below is out of date. The senior engineer's trial run on a temp copy showed two parts of it no longer match the tooling:

pypa/gh-action-pypi-publish is replaced by maturin's own uv publish --trusted-publishing.
The working-directory hand edits are no longer needed.

Owner to decide whether to rewrite the criterion when S3.4 starts. Details are under "Findings carried in from S3.2" below.

All actions on current majors: checkout / setup-python / setup-node v7, upload-artifact v7, download-artifact v8, actions/attest v4, release-please-action v5, actions-gh-pages v4
No 'latest' tool versions in any workflow (wasm-pack, mdbook pinned)
pypi.yml regenerated with maturin 1.15 generate-ci github; hand edits (working-directory: ./oxmpl-py) preserved; publish via PyPI Trusted Publishing (pypa/gh-action-pypi-publish); PYPI_API_TOKEN unused
crates.io: cargo publish --workspace via rust-lang/crates-io-auth-action; sed rewrite + sleep 60 removed; workspace path deps carry versions bumped by release-please
cargo publish --workspace --dry-run runs on every PR
jetli/wasm-pack-action removed (npm build uses the wasm-pack devDependency)
Docs workflow builds with pinned mdbook 0.5.x
.github/dependabot.yml: github-actions, cargo, npm, pip — monthly, grouped
All workflows green on the PR; release jobs exercised once via workflow_dispatch (no publish)

Tasks

Diff regenerated pypi.yml against the old one before committing
Release-please config: path-dep versions bumped in extra-files
Owner prerequisites (registering trusted publishers) are tracked in S3.6

Findings carried in from S3.2 (2026-10-09)

A trial regeneration of pypi.yml with maturin 1.15 was run on a temp copy and passed. The file is saved at /tmp/pypi.regenerated.yml, which is ephemeral; regenerate if it is gone.

Config moved to pyproject: CLI flags are deprecated. Add [tool.maturin.generate-ci.github] with pytest = true and trusted-publishing = true to oxmpl-py/pyproject.toml. The publish step becomes uv publish --trusted-publishing always, and PYPI_API_TOKEN disappears.
AC drift (owner to decide): the generator's own Trusted Publishing path (uv publish) replaces the AC's pypa/gh-action-pypi-publish. The AC's "hand edits (working-directory) preserved" is obsolete: the generator now passes --manifest-path oxmpl-py/Cargo.toml itself.
Hand edits still needed after generating:
- restore triggers: tags + PRs to main (generated: push to main/master + all PRs); name: pypi
- bump actions maturin pins one major behind: checkout/setup-python/upload-artifact v6→v7, download-artifact v7→v8, setup-uv v7→v10 (attest@v4 current)
- regenerate with -o .github/workflows/pypi.yml so the header comment records the right command
Verified locally: actionlint clean; wheel job args build; sdist builds and rebuilds standalone; the generated pytest step passes 34/34. Not run on Actions.
Risks:
- Emulated pytest (aarch64/s390x/ppc64le under QEMU) may be slow; drop it on those targets if CI time hurts.
- The module is pinned gil_used = true (S3.2). Check that --find-interpreter does not ship untested cp313t wheels.

Source

Agreed in the senior-engineer grilling session 2026-10-08 (decisions in repo docs/planning/adr/0003-motion-validation.md, glossary in CONTEXT.md; toolchain research briefs in the same session).