Skip to content

Releasing with a VERSION file has a footgun #155

Description

@ktbarrett

If you have a version_file setup and push a tag, the release template that pull in the version info from the file will be used regardless of the value of that tag. We just encountered an issue where we were trying to release an rc prerelease package, so we pushed a tag v2.1.0rc1 and this created the package 2.1.0 by looking directly at the VERSION file. This is definitely on us since we had an LLM cook up the scripts and didn't see through it's faulty assumptions.

I think what we want is the tag be compared against the called out version in the version_file; see that it is compatible since it's a pre, final, or post release; and then use the tag's value over the VERSION file. But in cases where there is no tag, it uses the VERSION file with the derived dev count in the dev template. I would expect we would have to fill in tag_formatter (since tags are currently v{version}) or switch to using the actual PEP compliant version number as the tag.

That all can be accomplished right now with a custom version callback. My questions are.

  1. Should what I described be standard behavior?
  2. Maybe optional behavior behind a flag?
  3. Instead of 1 or in addition to 2, I feel there needs to be a strict check that the tag and version are equal, just to prevent this footgun from shooting someone else.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions