fix(release): bump pypi-publish action to v1.14.2 for Metadata-Version 2.5 - #94
Merged
Conversation
…n 2.5 The 0.2.27 release tagged successfully but "Publish to PyPI" failed, so nothing reached PyPI and the latest installable version is still 0.2.26. twine's pre-upload check inside the pinned pypa/gh-action-pypi-publish image rejected the two hatchling-built wheels (deepctl-cmd-plugin, deepctl-cmd-skills) with "'2.5' is not a valid metadata version": the pkginfo bundled in that old image predates Metadata-Version 2.5, which current hatchling emits. The other 29 packages build with setuptools and emit 2.4, so they were unaffected. `make verify-packages` passed in the Build job because CI's own twine is current — only the action's bundled copy was stale. The failure surfaced now because hatchling was upgraded in the lockfile after 0.2.26 shipped. Pin ed0c539 -> dc37677 (v1.14.2), whose twine understands Metadata 2.5. Verified locally against the v0.2.27 tree: all 62 artifacts (31 wheels + 31 sdists), including both Metadata 2.5 wheels, pass `twine check` on twine 7.0.0. v0.2.27 is tagged but unpublished and cannot be re-published (release.yml's publish job is gated on release-please's release_created, which is only true on the run that cuts a release). Rolling forward instead: this fix cuts 0.2.28, which ships identical code plus this pipeline fix.
publish-on-release.yml is the human-triggered recovery path (fires on `release: published`) and carried the same ed0c539 pin, so recovery publishes would fail on Metadata-Version 2.5 exactly like the 0.2.27 release did. Both publish paths are now on v1.14.2 (twine 7.0.0). No ed0c539 references remain under .github/.
Merged
GregHolmes
added a commit
that referenced
this pull request
Aug 18, 2026
0.2.27 was tagged on 2026-08-17 but its publish step failed on Metadata-Version 2.5 (fixed afterwards by #94 and #95), so it never reached PyPI. Everyone upgrading therefore goes 0.2.26 -> 0.2.28 and receives the 0.2.27 changes in this release, while the generated notes list only commits made since the v0.2.27 tag. The gap matters most for #89, which changed the default `dg speak` model from Aura 2 to Flux TTS: a user whose synthesised audio changes after this upgrade would find nothing in the 0.2.28 notes to explain it. Also records the six packages that reach PyPI for the first time here, having been tagged in the failed cycle. Mirrored into the release PR body so the published release notes and the committed changelog match.
GregHolmes
added a commit
that referenced
this pull request
Aug 19, 2026
🤖 I have created a release *beep* *boop* --- <details><summary>0.3.0</summary> ## [0.3.0](v0.2.27...v0.3.0) (2026-08-19) ### ⚠ BREAKING CHANGES * `dg` now exits non-zero when a command fails: 1 for errors (including crashes and usage errors), 2 for user interrupt, 0 on success. Every command previously exited 0 regardless of outcome, so scripts and CI steps that ignored the exit code will surface failures they were silently swallowing. No command that succeeds changes its exit code. ### Bug Fixes * correct web command examples, document Flux TTS/STT, and honor -o json across account commands ([#97](#97)) ([55984ec](55984ec)) * dependency floors that let dg update skip this release, and exit-code + error-stream correctness ([#102](#102)) ([fd1e8a4](fd1e8a4)) * **deps:** cap mcp <2 (fixes broken dg mcp), commit uv.lock, require twine >=7 ([#95](#95)) ([997cd36](997cd36)) * **deps:** raise deepctl-core floor to 0.2.16 in the eight packages that import get_status_console ([98f9e91](98f9e91)) * **deps:** raise root dependency floors to the versions this release publishes ([c0b0023](c0b0023)) * exit 1, not 2, when a command crashes or is misused ([914e132](914e132)) * keep exit 2 when Ctrl-C interrupts a running command ([b0e80e2](b0e80e2)) * **keys:** honor -o json so stdout stays parseable (completes the [#97](#97) sweep) ([#101](#101)) ([e430a77](e430a77)) * **release:** bump pypi-publish action to v1.14.2 for Metadata-Version 2.5 ([#94](#94)) ([582cd83](582cd83)) * send root error and interrupt output to stderr, not stdout ([f4b7c48](f4b7c48)) * **web:** repair broken Heap snippet, upgrade astro 6→7, clear all 20 npm alerts ([#96](#96)) ([11928fe](11928fe)) ### Behavior changes Alongside the exit-code change above, upgrading to 0.3.0 changes these: * The full exit-code contract is now enforced end to end: `0` = success, `1` = error, `2` = user interrupt. Crashes **and usage errors** (bad flag, unknown command, bare `dg`) exit `1`; `2` is reserved for cancellation, so Ctrl-C during a running command and Ctrl-D at a prompt both still exit `2`. * Error and cancellation messages are written to **stderr** instead of stdout. `dg -o json …` therefore keeps stdout machine-readable when a command fails — previously a failure printed `Error: …` prose to stdout, so a script piping stdout into `jq` parsed the error text instead of JSON. Successful commands still write their payload to stdout. * `-o yaml` and `-o csv` no longer drop square-bracketed text from values. Output was passed through a renderer that read `[...]` as style markup and deleted it, so an API key comment of `[ci] runner` was emitted as `runner`. Long values are also no longer hard-wrapped mid-field. * `dg keys --delete KEY_ID` now asks for confirmation on stderr instead of always reporting `Cancelled by user` without deleting. In a non-interactive context it exits `1` and tells you to pass `--yes`. * `dg keys --create --dry-run` now reports what it would create. It previously failed with an internal `TypeError`. ### Previously unreleased 0.2.27 was tagged on 2026-08-17 but never reached PyPI — its publish step failed with `InvalidDistribution: Invalid distribution metadata: '2.5' is not a valid metadata version`, which [#94](#94) and [#95](#95) then fixed. PyPI therefore goes straight from 0.2.26 to 0.3.0, and this release is the first published build to include the 0.2.27 changes: * SDK 7.7.0 — Flux TTS controls, Flux STT fix, listen redact/numerals ([#92](#92)) ([50d96cf](50d96cf)) * **speak:** default to Flux TTS (`flux-alexis-en`) instead of Aura 2 ([#89](#89)) ([5a0b698](5a0b698)). This changes the default model for `dg speak`, so synthesised audio differs unless you pass an `aura-*` model explicitly. * **mcp:** swallow broken/closed-pipe on dg mcp startup notifications and error path ([#88](#88)) ([b24396e](b24396e)) Six packages tagged in that cycle also reach PyPI for the first time here: `deepctl-cmd-listen` 0.0.14, `deepctl-cmd-login` 0.1.17, `deepctl-cmd-skills` 0.0.7, `deepctl-cmd-speak` 0.0.4, `deepctl-cmd-update` 0.2.6 and `deepctl-telemetry` 0.0.6. Because 0.2.27 never published, `dg update` on pip also had to be repaired for this release to arrive at all: root's inter-package dependency floors were lower than the versions being published, so pip's default `only-if-needed` strategy left most sub-packages stale and `dg --version` reported the new number while the fixes never landed. Floors now match the published versions exactly. </details> <details><summary>deepctl-core: 0.2.16</summary> ## [0.2.16](deepctl-core-v0.2.15...deepctl-core-v0.2.16) (2026-08-19) ### Bug Fixes * correct web command examples, document Flux TTS/STT, and honor -o json across account commands ([#97](#97)) ([55984ec](55984ec)) * **keys:** honor -o json so stdout stays parseable (completes the [#97](#97) sweep) ([#101](#101)) ([e430a77](e430a77)) ### Behavior changes * Commands now map their result status to a process exit code (`error` → `1`, `cancelled` → `2`, otherwise `0`), and `BaseCommand.exit_code_for()` exposes that mapping. Exit codes were previously discarded, so every command exited `0`. * `-o yaml` and `-o csv` payloads are written verbatim; the renderer no longer interprets `[...]` as markup or wraps long values. * New `get_status_console()` returns the shared stderr console for status output. Commands should use it instead of declaring their own. Packages that import it require `deepctl-core>=0.2.16`. </details> <details><summary>deepctl-cmd-projects: 0.2.0</summary> ## [0.2.0](deepctl-cmd-projects-v0.1.13...deepctl-cmd-projects-v0.2.0) (2026-08-19) ### ⚠ BREAKING CHANGES * `dg` now exits non-zero when a command fails: 1 for errors (including crashes and usage errors), 2 for user interrupt, 0 on success. Every command previously exited 0 regardless of outcome, so scripts and CI steps that ignored the exit code will surface failures they were silently swallowing. No command that succeeds changes its exit code. ### Bug Fixes * correct web command examples, document Flux TTS/STT, and honor -o json across account commands ([#97](#97)) ([55984ec](55984ec)) * dependency floors that let dg update skip this release, and exit-code + error-stream correctness ([#102](#102)) ([fd1e8a4](fd1e8a4)) * **deps:** raise deepctl-core floor to 0.2.16 in the eight packages that import get_status_console ([98f9e91](98f9e91)) * **keys:** honor -o json so stdout stays parseable (completes the [#97](#97) sweep) ([#101](#101)) ([e430a77](e430a77)) </details> <details><summary>deepctl-cmd-usage: 0.2.0</summary> ## [0.2.0](deepctl-cmd-usage-v0.1.13...deepctl-cmd-usage-v0.2.0) (2026-08-19) ### ⚠ BREAKING CHANGES * `dg` now exits non-zero when a command fails: 1 for errors (including crashes and usage errors), 2 for user interrupt, 0 on success. Every command previously exited 0 regardless of outcome, so scripts and CI steps that ignored the exit code will surface failures they were silently swallowing. No command that succeeds changes its exit code. ### Bug Fixes * correct web command examples, document Flux TTS/STT, and honor -o json across account commands ([#97](#97)) ([55984ec](55984ec)) * dependency floors that let dg update skip this release, and exit-code + error-stream correctness ([#102](#102)) ([fd1e8a4](fd1e8a4)) * **deps:** raise deepctl-core floor to 0.2.16 in the eight packages that import get_status_console ([98f9e91](98f9e91)) * **keys:** honor -o json so stdout stays parseable (completes the [#97](#97) sweep) ([#101](#101)) ([e430a77](e430a77)) </details> <details><summary>deepctl-cmd-mcp: 0.1.15</summary> ## [0.1.15](deepctl-cmd-mcp-v0.1.14...deepctl-cmd-mcp-v0.1.15) (2026-08-19) ### Bug Fixes * **deps:** cap mcp <2 (fixes broken dg mcp), commit uv.lock, require twine >=7 ([#95](#95)) ([997cd36](997cd36)) </details> <details><summary>deepctl-cmd-models: 0.1.0</summary> ## [0.1.0](deepctl-cmd-models-v0.0.2...deepctl-cmd-models-v0.1.0) (2026-08-19) ### ⚠ BREAKING CHANGES * `dg` now exits non-zero when a command fails: 1 for errors (including crashes and usage errors), 2 for user interrupt, 0 on success. Every command previously exited 0 regardless of outcome, so scripts and CI steps that ignored the exit code will surface failures they were silently swallowing. No command that succeeds changes its exit code. ### Bug Fixes * correct web command examples, document Flux TTS/STT, and honor -o json across account commands ([#97](#97)) ([55984ec](55984ec)) * dependency floors that let dg update skip this release, and exit-code + error-stream correctness ([#102](#102)) ([fd1e8a4](fd1e8a4)) * **deps:** raise deepctl-core floor to 0.2.16 in the eight packages that import get_status_console ([98f9e91](98f9e91)) * **keys:** honor -o json so stdout stays parseable (completes the [#97](#97) sweep) ([#101](#101)) ([e430a77](e430a77)) </details> <details><summary>deepctl-cmd-keys: 0.1.0</summary> ## [0.1.0](deepctl-cmd-keys-v0.0.3...deepctl-cmd-keys-v0.1.0) (2026-08-19) ### ⚠ BREAKING CHANGES * `dg` now exits non-zero when a command fails: 1 for errors (including crashes and usage errors), 2 for user interrupt, 0 on success. Every command previously exited 0 regardless of outcome, so scripts and CI steps that ignored the exit code will surface failures they were silently swallowing. No command that succeeds changes its exit code. ### Bug Fixes * dependency floors that let dg update skip this release, and exit-code + error-stream correctness ([#102](#102)) ([fd1e8a4](fd1e8a4)) * **deps:** raise deepctl-core floor to 0.2.16 in the eight packages that import get_status_console ([98f9e91](98f9e91)) * **keys:** honor -o json so stdout stays parseable (completes the [#97](#97) sweep) ([#101](#101)) ([e430a77](e430a77)) </details> <details><summary>deepctl-cmd-read: 0.1.0</summary> ## [0.1.0](deepctl-cmd-read-v0.0.2...deepctl-cmd-read-v0.1.0) (2026-08-19) ### ⚠ BREAKING CHANGES * `dg` now exits non-zero when a command fails: 1 for errors (including crashes and usage errors), 2 for user interrupt, 0 on success. Every command previously exited 0 regardless of outcome, so scripts and CI steps that ignored the exit code will surface failures they were silently swallowing. No command that succeeds changes its exit code. ### Bug Fixes * correct web command examples, document Flux TTS/STT, and honor -o json across account commands ([#97](#97)) ([55984ec](55984ec)) * dependency floors that let dg update skip this release, and exit-code + error-stream correctness ([#102](#102)) ([fd1e8a4](fd1e8a4)) * **deps:** raise deepctl-core floor to 0.2.16 in the eight packages that import get_status_console ([98f9e91](98f9e91)) * **keys:** honor -o json so stdout stays parseable (completes the [#97](#97) sweep) ([#101](#101)) ([e430a77](e430a77)) </details> <details><summary>deepctl-cmd-requests: 0.1.0</summary> ## [0.1.0](deepctl-cmd-requests-v0.0.2...deepctl-cmd-requests-v0.1.0) (2026-08-19) ### ⚠ BREAKING CHANGES * `dg` now exits non-zero when a command fails: 1 for errors (including crashes and usage errors), 2 for user interrupt, 0 on success. Every command previously exited 0 regardless of outcome, so scripts and CI steps that ignored the exit code will surface failures they were silently swallowing. No command that succeeds changes its exit code. ### Bug Fixes * correct web command examples, document Flux TTS/STT, and honor -o json across account commands ([#97](#97)) ([55984ec](55984ec)) * dependency floors that let dg update skip this release, and exit-code + error-stream correctness ([#102](#102)) ([fd1e8a4](fd1e8a4)) * **deps:** raise deepctl-core floor to 0.2.16 in the eight packages that import get_status_console ([98f9e91](98f9e91)) * **keys:** honor -o json so stdout stays parseable (completes the [#97](#97) sweep) ([#101](#101)) ([e430a77](e430a77)) </details> <details><summary>deepctl-cmd-billing: 0.1.0</summary> ## [0.1.0](deepctl-cmd-billing-v0.0.2...deepctl-cmd-billing-v0.1.0) (2026-08-19) ### ⚠ BREAKING CHANGES * `dg` now exits non-zero when a command fails: 1 for errors (including crashes and usage errors), 2 for user interrupt, 0 on success. Every command previously exited 0 regardless of outcome, so scripts and CI steps that ignored the exit code will surface failures they were silently swallowing. No command that succeeds changes its exit code. ### Bug Fixes * correct web command examples, document Flux TTS/STT, and honor -o json across account commands ([#97](#97)) ([55984ec](55984ec)) * dependency floors that let dg update skip this release, and exit-code + error-stream correctness ([#102](#102)) ([fd1e8a4](fd1e8a4)) * **deps:** raise deepctl-core floor to 0.2.16 in the eight packages that import get_status_console ([98f9e91](98f9e91)) * **keys:** honor -o json so stdout stays parseable (completes the [#97](#97) sweep) ([#101](#101)) ([e430a77](e430a77)) </details> <details><summary>deepctl-cmd-members: 0.1.0</summary> ## [0.1.0](deepctl-cmd-members-v0.0.3...deepctl-cmd-members-v0.1.0) (2026-08-19) ### ⚠ BREAKING CHANGES * `dg` now exits non-zero when a command fails: 1 for errors (including crashes and usage errors), 2 for user interrupt, 0 on success. Every command previously exited 0 regardless of outcome, so scripts and CI steps that ignored the exit code will surface failures they were silently swallowing. No command that succeeds changes its exit code. ### Bug Fixes * correct web command examples, document Flux TTS/STT, and honor -o json across account commands ([#97](#97)) ([55984ec](55984ec)) * dependency floors that let dg update skip this release, and exit-code + error-stream correctness ([#102](#102)) ([fd1e8a4](fd1e8a4)) * **deps:** raise deepctl-core floor to 0.2.16 in the eight packages that import get_status_console ([98f9e91](98f9e91)) * **keys:** honor -o json so stdout stays parseable (completes the [#97](#97) sweep) ([#101](#101)) ([e430a77](e430a77)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
The
0.2.27release tagged successfully, butPublish to PyPIfailed — nothing reached PyPI. The latest installable version is still0.2.26(pypi.org/pypi/deepctl/0.2.27/json→ 404).The pinned
pypa/gh-action-pypi-publishimage runs atwine checkbefore uploading, and it rejected two wheels:Root cause
deepctl-cmd-plugin,deepctl-cmd-skills) build with hatchling, which now emitsMetadata-Version: 2.5. The other 29 use setuptools and emit2.4.pkginfobundled inside the old pinned action image predates Metadata 2.5, so itstwine checkerrors out — aborting the step before any upload happened.make verify-packagespassed in theBuildjob because CI's own twine is current. Only the action's bundled copy was stale.0.2.26) because hatchling was upgraded in the lockfile after0.2.26shipped.The fix
Bump the action pin
ed0c539→dc37677(v1.14.2), whose twine understands Metadata 2.5.Verified locally against the
v0.2.27tree: all 62 artifacts (31 wheels + 31 sdists), including bothMetadata-Version: 2.5wheels,PASSEDtwine checkon twine 7.0.0.Why this rolls forward to 0.2.28 instead of republishing 0.2.27
v0.2.27is tagged with a GitHub Release but has no PyPI artifact, and it cannot be re-published:release.yml's build/test/publish jobs are gated on release-please'srelease_created, which is only true on the run that cuts a release. Re-running the failed run would also reuse the old (broken) pin.So merging this cuts 0.2.28, which ships identical code to 0.2.27 plus this pipeline fix. The follow-up release PR will carry the full 0.2.27 feature set (Flux TTS default, Flux controls, listen redact/numerals, SDK 7.7.0, MCP pipe-safety) through to PyPI.
v0.2.27stays as a tag/GitHub Release with no PyPI artifact — worth a note on that release so nobody hunts forpip install deepctl==0.2.27.Follow-ups (not in this PR)
attestations: trueis ignored because an explicit password is set. Harmless, but silenceable withattestations: false— or resolved properly by moving to Trusted Publishing (the action already prints the enablement links).#92was a scope-less squashedfeat:whose README/pyprojectpin edits rippled intodeepctl-cmd-login/projects/usage, giving those packages a "Flux TTS controls" feature entry they didn't gain. Per-package commit scoping (or a path filter) would prevent that.