Skip to content

Add concise Temporal-backed Python release automation - #2995

Open
eamsden wants to merge 37 commits into
mainfrom
eamsden/temporal-release-automation-python
Open

Add concise Temporal-backed Python release automation#2995
eamsden wants to merge 37 commits into
mainfrom
eamsden/temporal-release-automation-python

Conversation

@eamsden

@eamsden eamsden commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

What changed?

  • Replaced the Java/Gradle release-orchestration module with an opinionated Temporal Python SDK implementation.
  • Starts and completes a release in the GitHub Actions run triggered when an SDK owner merges a valid release-note file; no timer, separate approval issue, ownership workflow, manual takeover, or recovery UI remains.
  • Uses the approved merge SHA as the sole immutable source and automation identity, with release-specific Workflow queues, generation-specific publication queues, credential-free native builds, exact GitHub Actions artifact receipts, and GitHub App authentication for publication.
  • Keeps Maven payload isolation and signing, bounded ambiguity generations, exact Sonatype/Portal/Maven Central reconciliation, and draft-first GitHub assets with public-last publication.
  • Carries one exact Temporal Workflow ID and run ID through the merge-triggered native-build, receipt, and publication jobs instead of periodically discovering every open release.

The measured release-automation surface is 3,506 lines across 20 files, down from 7,548 lines across 34 files at the initial Python checkpoint. Excluding tests and the generated lockfile, the authored operational surface is 2,819 lines.

Why?

This is the smaller Python alternative to #2986. It preserves Temporal-backed orchestration and the hard Maven/GitHub reconciliation boundaries while removing approval, ownership, handoff, redundant manifests, duplicate validation, Java/Gradle scaffolding, unnecessary Actions glue, and scheduled polling.

Breaking changes?

No SDK API changes. Release operations remain inactive until the required Temporal deployment, GitHub App, signing, and Maven credentials are configured.

The former manual prepare-release.yml path is intentionally removed. Merging a valid release-note file is the release authorization and execution trigger.

Verification

  • 11 local tests using the Temporal ephemeral test server and mocked publication activities
  • Ruff formatting and lint
  • Strict mypy
  • uv lock --check
  • Shell syntax plus GitHub artifact and native packaging tests
  • Workflow YAML parsing
  • No scheduled or manual dispatch entrypoint in the Temporal release workflow

No release, test release, Maven publication, tag, GitHub release, or external Temporal operation was run while developing or testing this change.

Server PR

None.

Supersedes #2986.

eamsden added 29 commits August 10, 2026 14:34
Orchestrate immutable sdk-java release candidates with transient GitHub Actions Workers, a no-input approval Update, privileged publication queues, and exact-state external reconciliation.
Make release progress explicitly staged and controllable, bind approval to a locked release-specific GitHub issue, and make Maven and GitHub publication reconciliation safe across ambiguous retries. Add a durable emergency handoff path, frozen Worker routing, prompt Activity cancellation, idempotent native builds, and focused local tests.
Harden the Temporal state machine, publication reconciliation, approval recovery, and transient Worker behavior. Add protected Maven generation authorization, draft-first exact asset handling, maintenance-branch recovery, and both automated and independent emergency paths.
Bind release workflows to the exact receipted Candidate run, separate candidate compilation from credentialed artifact storage, adopt fallback artifacts across reruns, and classify S3 absence without masking service failures.
@eamsden
eamsden force-pushed the eamsden/temporal-release-automation-python branch from fa2ee95 to 551ff6c Compare August 10, 2026 19:35
@eamsden
eamsden marked this pull request as ready for review August 10, 2026 19:36
@eamsden
eamsden requested a review from a team as a code owner August 10, 2026 19:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant