Repository navigation
Pin build and twine versions in the package and publish jobs #303
Description
Follow-up from durable-workflow/.github#187 (the 2026-11-06 disposition of the SonarQube SECURITY keys for sdk-python):
- Key AaFA6uzUrKpiHhFp4uwn (policy CI, S8541): apply the same narrow wheel-only PyYAML 6.0.2 correction the other SDKs use.
- Keys AaFA6uzUrKpiHhFp4uww/uwx (package job) and AaFA6uzcrKpiHhFp4uw0/uw1 (publisher): both jobs install unversioned
build/twine. Pin exact versions so the build tooling is reproducible.
Acceptance: exact pinned versions in both jobs, wheel-only PyYAML, and green CI showing the pinned tools are the ones used.
Activity
rmcdaniel commentedon Nov 13, 2026
Owner: sdk-python. Taking the pinned build/twine and wheel-only PyYAML follow-up after #304. Next: inspect the current package/publish steps, select compatible exact tool versions, and validate the package path in CI. No external blocker.
rmcdaniel commentedon Nov 13, 2026
Implementation is on fix/sdk-python-303-package-tool-pins: build==1.6.1 and twine==7.0.0 in package and publisher build jobs, wheel-only PyYAML==6.0.2 in policy preflight. Exact-tool local build, twine checks and metadata comparison pass. Owner: sdk-python; next: required CI and Security review, then merge and verify the next publication uses these pins.
rmcdaniel commentedon Nov 13, 2026
Delivered in published Python SDK 2.17.1 through #314 (incorporating reviewed #313). The ordinary package check and protected publication run https://github.com/durable-workflow/sdk-python/actions/runs/43404343836 both used wheel-only build==1.6.1 and twine==7.0.0; policy preflight used the approved wheel-only PyYAML==6.0.2 command. All checks passed and the published package was independently installed and verified. Evidence is on #314.