Repository: BlueCentre/cli-code
Pull request #3: Fix PyPI publishing and add release documentation
Author: login: ipv1337
Created: 2025-04-07T04:15:45Z | Merged: 2025-04-07T04:18:05Z



Diff:
diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml
index cf2cd9e..932c6ac 100644
--- a/.github/workflows/python-ci.yml
+++ b/.github/workflows/python-ci.yml
@@ -118,7 +118,8 @@ jobs:
     runs-on: ubuntu-latest
     environment: publish
     permissions:
-      id-token: write  # Required for PyPI publishing with trusted publishing
+      id-token: write  # Required for PyPI trusted publishing
+      contents: read   # Required for actions/checkout
       
     steps:
     - name: Download built packages
@@ -127,5 +128,24 @@ jobs:
         name: dist
         path: dist/
         
-    - name: Publish to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1 
\ No newline at end of file
+    - name: Display packages to be published
+      run: |
+        echo "Packages to be published:"
+        ls -la dist/
+
+    # Option 1: Use Trusted Publishing (OIDC)
+    - name: Publish to PyPI using Trusted Publishing
+      if: ${{ !env.ACT && env.USE_TRUSTED_PUBLISHING == 'true' }}
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        verbose: true
+        print-hash: true
+
+    # Option 2: Use API Token
+    - name: Publish to PyPI using Token
+      if: ${{ !env.ACT && (env.USE_TRUSTED_PUBLISHING != 'true') }}
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        password: ${{ secrets.PYPI_API_TOKEN }}
+        verbose: true
+        print-hash: true 
\ No newline at end of file
diff --git a/RELEASE.md b/RELEASE.md
new file mode 100644
index 0000000..3bf5018
--- /dev/null
+++ b/RELEASE.md
@@ -0,0 +1,76 @@
+# Release Process for cli-code-agent
+
+This document outlines the steps to release new versions of the `cli-code-agent` package to PyPI.
+
+## Prerequisites
+
+1. GitHub repository access with permissions to push tags and create releases
+2. PyPI account with permissions to publish the package
+
+## Setup
+
+### 1. Configure PyPI API Token
+
+You can use either Trusted Publishing (OIDC) or a PyPI API token for publishing:
+
+#### Option A: API Token (Simpler)
+
+1. Generate a PyPI API token:
+   - Go to https://pypi.org/manage/account/
+   - Navigate to API tokens and create a new token with scope limited to the `cli-code-agent` project
+   - Copy the token value (it will only be shown once)
+
+2. Add the token to GitHub repository secrets:
+   - Go to your GitHub repository → Settings → Secrets and variables → Actions
+   - Create a new repository secret named `PYPI_API_TOKEN`
+   - Paste the PyPI token value
+
+#### Option B: Trusted Publishing (More Secure)
+
+Set up Trusted Publishing between GitHub and PyPI:
+   
+1. On PyPI:
+   - Go to your project page
+   - Navigate to "Settings" → "Publishing"
+   - Add a new "Pending publisher"
+   - Select GitHub as the workflow
+   - Enter `BlueCentre/cli-code` as the owner/repo
+   - Enter `.github/workflows/python-ci.yml` as the workflow name
+   - Save the publisher
+
+2. On GitHub:
+   - Create an environment named `publish` in your repository settings
+   - Set the environment variable `USE_TRUSTED_PUBLISHING=true`
+
+### 2. Creating a Release
+
+1. Update version in `pyproject.toml`:
+   ```toml
+   version = "x.y.z"  # Update this line
+   ```
+
+2. Commit the version change:
+   ```bash
+   git add pyproject.toml
+   git commit -m "Bump version to x.y.z"
+   ```
+
+3. Create and push a tag:
+   ```bash
+   git tag -a vx.y.z -m "Release version x.y.z"
+git push origin main
+git push origin vx.y.z
+   ```
+
+4. Monitor the CI workflow in GitHub Actions to verify the release process completes successfully.
+
+5. Check that the package appears on PyPI at https://pypi.org/project/cli-code-agent/
+
+## Troubleshooting
+
+If the release fails, check:
+
+1. GitHub Actions logs for error messages
+2. Verify that the tag format is correct (should start with 'v')
+3. Ensure the PyPI token has not expired
+4. Verify that the package version is unique (PyPI rejects duplicate versions) 
\ No newline at end of file


Reviews:
user: login: gemini-code-assist[bot]
body: Hello @ipv1337, I'm Gemini Code Assist[^1]! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

## Summary of Changes
This pull request addresses issues related to PyPI publishing for the `cli-code-agent` package and introduces comprehensive release documentation. The primary goal is to streamline the release process and ensure successful package publication to PyPI. The changes involve the addition of a `RELEASE.md` file, which provides step-by-step instructions for configuring PyPI credentials (using either API tokens or Trusted Publishing) and creating releases. This documentation aims to guide developers through the necessary steps, including version updates, tag creation, and CI workflow monitoring.

### Highlights
* **Release Documentation**: A new `RELEASE.md` file has been added to provide detailed instructions on how to release new versions of the `cli-code-agent` package to PyPI.
* **PyPI Configuration**: The documentation outlines two methods for configuring PyPI credentials: using a PyPI API token or setting up Trusted Publishing (OIDC) for enhanced security.
* **Release Steps**: The documentation details the steps required to create a release, including updating the version in `pyproject.toml`, committing the changes, creating and pushing a tag, and monitoring the CI workflow.

### Changelog
* **RELEASE.md**
  * Added a new file `RELEASE.md` to document the release process for the `cli-code-agent` package.
  * The file includes instructions for configuring PyPI credentials using either an API token or Trusted Publishing.
  * It provides a step-by-step guide for creating releases, including version updates, tag creation, and CI workflow monitoring.
  * It also includes a troubleshooting section to address common release issues.


<details>

<summary><b>Using Gemini Code Assist</b></summary>
<br>

The full guide for Gemini Code Assist can be found on our [documentation page](https://developers.google.com/gemini-code-assist/docs/review-github-code), here are some quick tips.

<b>Invoking Gemini</b>

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either `/gemini <command>` or `@gemini-code-assist <command>`. Below is a summary of the supported commands.

Feature | Command | Description
--- | --- | ---
Code Review | `/gemini review` | Performs a code review for the current pull request in its current state.
Pull Request Summary | `/gemini summary` | Provides a summary of the current pull request in its current state.
Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments.
Help | `/gemini help` | Displays a list of available commands.

<b>Customization</b>

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a `.gemini/` folder in the base of the repository. Detailed instructions can be found [here](https://developers.google.com/gemini-code-assist/docs/customize-gemini-behavior-github).

<b>Limitations & Feedback</b>

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with :thumbsup: and :thumbsdown: on @gemini-code-assist comments to provide feedback.

</details>

<b>You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the [Gemini Code Assist IDE Extension](https://cloud.google.com/products/gemini/code-assist).</b>


[^1]: Review the [Privacy Notices](https://policies.google.com/privacy), [Generative AI Prohibited Use Policy](https://policies.google.com/terms/generative-ai/use-policy), [Terms of Service](https://policies.google.com/terms), and learn how to configure Gemini Code Assist in GitHub [here](https://developers.google.com/gemini-code-assist/docs/review-github-code). Gemini can make mistakes, so double check it and [use code with caution](https://support.google.com/legal/answer/13505487).

---

> To PyPI, our code we send,
> With versions new, our work extend.
> Docs guide the way,
> For releases each day,
> Ensuring our project transcend.


state: COMMENTED
author_association: NONE
submitted_at: 2025-04-07T04:15:53Z
user: login: gemini-code-assist[bot]
body: ## Code Review
The pull request introduces a release process documentation for the `cli-code-agent` package, which is a valuable addition to the project. The documentation covers the necessary steps for publishing new versions to PyPI, including configuration of PyPI API tokens and trusted publishing. Overall, the documentation is well-structured and easy to follow. However, there are a few areas that could be improved for clarity and completeness.

### Summary of Findings
* **Incomplete Tag Pushing**: The release process documentation is missing a step to push the created tag to the remote repository. This omission could lead to confusion and prevent the release workflow from triggering correctly.
* **Missing Version Update Verification**: The documentation does not explicitly mention verifying the updated version in `pyproject.toml` before committing the changes. This verification step is crucial to ensure that the correct version is being released.

### Merge Readiness
The release process documentation is a valuable addition to the project and is generally well-written. However, the missing tag pushing step and version update verification should be addressed before merging. I am unable to approve the pull request, and recommend that others review and approve this code before merging.
state: CHANGES_REQUESTED
author_association: NONE
submitted_at: 2025-04-07T04:16:00Z

Review comments:
diff_hunk: @@ -0,0 +1,76 @@
+# Release Process for cli-code-agent
+
+This document outlines the steps to release new versions of the `cli-code-agent` package to PyPI.
+
+## Prerequisites
+
+1. GitHub repository access with permissions to push tags and create releases
+2. PyPI account with permissions to publish the package
+
+## Setup
+
+### 1. Configure PyPI API Token
+
+You can use either Trusted Publishing (OIDC) or a PyPI API token for publishing:
+
+#### Option A: API Token (Simpler)
+
+1. Generate a PyPI API token:
+   - Go to https://pypi.org/manage/account/
+   - Navigate to API tokens and create a new token with scope limited to the `cli-code-agent` project
+   - Copy the token value (it will only be shown once)
+
+2. Add the token to GitHub repository secrets:
+   - Go to your GitHub repository → Settings → Secrets and variables → Actions
+   - Create a new repository secret named `PYPI_API_TOKEN`
+   - Paste the PyPI token value
+
+#### Option B: Trusted Publishing (More Secure)
+
+Set up Trusted Publishing between GitHub and PyPI:
+   
+1. On PyPI:
+   - Go to your project page
+   - Navigate to "Settings" → "Publishing"
+   - Add a new "Pending publisher"
+   - Select GitHub as the workflow
+   - Enter `BlueCentre/cli-code` as the owner/repo
+   - Enter `.github/workflows/python-ci.yml` as the workflow name
+   - Save the publisher
+
+2. On GitHub:
+   - Create an environment named `publish` in your repository settings
+   - Set the environment variable `USE_TRUSTED_PUBLISHING=true`
+
+### 2. Creating a Release
+
+1. Update version in `pyproject.toml`:
+   ```toml
+   version = "x.y.z"  # Update this line
+   ```
+
+2. Commit the version change:
+   ```bash
+   git add pyproject.toml
+   git commit -m "Bump version to x.y.z"
+   ```
+
+3. Create and push a tag:
+   ```bash
+   git tag -a vx.y.z -m "Release version x.y.z"
+   git push origin main
+   git push origin vx.y.z
path: RELEASE.md
user: login: gemini-code-assist[bot]
body: ![high](https://img.shields.io/badge/priority-high-orange)

The documentation is missing a step to push the created tag to the remote repository. This omission could lead to confusion and prevent the release workflow from triggering correctly. It's important to explicitly include the command to push the tag to ensure the release workflow is triggered correctly.

```suggestion
git push origin main
git push origin vx.y.z
```
created_at: 2025-04-07T04:16:00Z
author_association: NONE
diff_hunk: @@ -0,0 +1,76 @@
+# Release Process for cli-code-agent
+
+This document outlines the steps to release new versions of the `cli-code-agent` package to PyPI.
+
+## Prerequisites
+
+1. GitHub repository access with permissions to push tags and create releases
+2. PyPI account with permissions to publish the package
+
+## Setup
+
+### 1. Configure PyPI API Token
+
+You can use either Trusted Publishing (OIDC) or a PyPI API token for publishing:
+
+#### Option A: API Token (Simpler)
+
+1. Generate a PyPI API token:
+   - Go to https://pypi.org/manage/account/
+   - Navigate to API tokens and create a new token with scope limited to the `cli-code-agent` project
+   - Copy the token value (it will only be shown once)
+
+2. Add the token to GitHub repository secrets:
+   - Go to your GitHub repository → Settings → Secrets and variables → Actions
+   - Create a new repository secret named `PYPI_API_TOKEN`
+   - Paste the PyPI token value
+
+#### Option B: Trusted Publishing (More Secure)
+
+Set up Trusted Publishing between GitHub and PyPI:
+   
+1. On PyPI:
+   - Go to your project page
+   - Navigate to "Settings" → "Publishing"
+   - Add a new "Pending publisher"
+   - Select GitHub as the workflow
+   - Enter `BlueCentre/cli-code` as the owner/repo
+   - Enter `.github/workflows/python-ci.yml` as the workflow name
+   - Save the publisher
+
+2. On GitHub:
+   - Create an environment named `publish` in your repository settings
+   - Set the environment variable `USE_TRUSTED_PUBLISHING=true`
+
+### 2. Creating a Release
+
+1. Update version in `pyproject.toml`:
+   ```toml
+   version = "x.y.z"  # Update this line
+   ```
path: RELEASE.md
user: login: gemini-code-assist[bot]
body: ![medium](https://img.shields.io/badge/priority-medium-yellow)

The documentation does not explicitly mention verifying the updated version in `pyproject.toml` before committing the changes. This verification step is crucial to ensure that the correct version is being released. Consider adding a step to verify the version before committing.

```suggestion
version = "x.y.z"  # Update this line
```
created_at: 2025-04-07T04:16:00Z
author_association: NONE

PR comments:
user: login: sonarqubecloud[bot]
created_at: 2025-04-07T04:17:54Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=BlueCentre_cli-code&pullRequest=3) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=BlueCentre_cli-code&pullRequest=3&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=BlueCentre_cli-code&pullRequest=3&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=BlueCentre_cli-code&pullRequest=3&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=BlueCentre_cli-code&pullRequest=3&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=BlueCentre_cli-code&pullRequest=3&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=BlueCentre_cli-code&pullRequest=3)


author_association: NONE