Skip to content

Harden release input handling in PyPI publishing workflow #4380

Description

@mnriem

Update .github/workflows/publish-pypi.yml so manually supplied release inputs are passed to shell steps through environment variables rather than embedded directly in run: blocks.

Apply this to both tag-validation steps while preserving current validation behavior.

Acceptance criteria

  • No direct ${{ inputs.tag }} interpolation inside shell scripts.
  • Valid vX.Y.Z tags remain accepted.
  • Invalid tags and package-version mismatches remain rejected.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions