Fix .ufazienignore matching and switch publish workflows to trusted publishing - #6
Merged
Merged
Conversation
Patterns like 'docs/' or '.claude/' were not excluded on Windows because the matcher compared raw absolute paths (using OS separators) against forward-slash patterns. Wildcard patterns like '*.log' silently failed too because the substring check would never hit. shouldExcludeFile now computes a forward-slash path relative to the project root and matches by path segment (for 'dir/'), basename extension (for '*.ext'), or exact basename / relative path.
Same issue as the npm package: 'docs/'-style directory patterns and '*.ext' wildcards never matched because the matcher compared the raw absolute filesystem path against the pattern string. should_exclude_file now computes a POSIX-normalized path relative to the project root and matches by path segment, basename extension, or exact basename / relative path.
Drop NPM_TOKEN auth in favor of OIDC trusted publishing. The workflow already has id-token: write; we now upgrade npm to the latest version (trusted publishing support landed in npm 11.5.1) and publish with --provenance so the registry records the build attestation. Requires a Trusted Publisher to be configured for the 'ufazien-cli' npm package pointing at this repo and workflow.
Drop PYPI_API_TOKEN/twine in favor of OIDC trusted publishing via pypa/gh-action-pypi-publish. The job now runs in a 'pypi' environment and exchanges its id-token for a short-lived PyPI token at publish time. Requires a Trusted Publisher to be configured for 'ufazien-cli' on PyPI pointing at this repo, the publish_python_pkg.yml workflow, and the 'pypi' environment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.ufazienignorematching in both the npm and Python packages. Directory patterns likedocs//.claude/never matched on Windows because the matcher compared absolute paths with OS separators against forward-slash patterns, and*.extwildcards silently failed because the substring check could never hit. Both packages now compute a forward-slash path relative to the project root and match by path segment, basename extension, or exact basename / relative path.--provenanceand noNPM_TOKEN; PyPI usespypa/gh-action-pypi-publishwith noPYPI_API_TOKEN.Required follow-up (out of code)
Before the next release, configure trusted publishers:
ufazien-clipackage settings → Trusted Publishers → add this repo, workflowpublish_npm_pkg.yml.ufazien-cliproject → Publishing → add this repo, workflowpublish_python_pkg.yml, environmentpypi. Also create apypienvironment in GitHub repo settings.Once configured, the existing
NPM_TOKENandPYPI_API_TOKENsecrets can be removed.Test plan
should_exclude_file(Python) —docs/,.claude/,*.logall excluded;src/andREADME.mdkept; zip contents verified.shouldExcludeFile(JS) — same patterns, same expected outcome; zip contents verified.tsc --noEmitpasses on the npm package.