A tag push ran python-tests.yml — lint, docs build, the test matrix — and
nothing else. CodeQL runs as GitHub default setup rather than from that
workflow, so release.yml never saw it, and a pull request's own CodeQL check
reports only what that diff introduces, which means an alert already open on
master passed every check a release went through.
release.yml now has a code-scanning job that build waits on, so a release
stops before it publishes anything rather than after. Everything else hangs
off build, so gating build gates the PyPI upload, the GitHub release, the
Docker image, and the docs deploy with it.
Reading the alert list is only meaningful if CodeQL has looked at the code
being released, and the tag is usually pushed moments after the commit lands
on master, while its analyses are still running. So the job first waits, up to
15 minutes, for an analysis of the tagged commit in every language CodeQL
covers. That set is read back from the analyses already published for the
default branch instead of hard-coded, so it cannot drift out of step with the
repository configuration, and a commit CodeQL never analyzed fails rather than
passing against a scan of different code.
A false positive is dismissed in the Security tab: a dismissed alert has state
"dismissed", not "open", so it stops blocking without needing an exception
here.
Co-authored-by: Sean Whalen <seanthegeek@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Port mailsuite's tag-triggered release pipeline:
- Add release.yml: pushing a version tag runs the full CI suite
(python-tests.yml via workflow_call), then builds the package (the tag
must match the version in parsedmarc/constants.py, checked with
`hatch version`), publishes to PyPI via Trusted Publishing, creates
the GitHub Release with notes from the tag's CHANGELOG.md section and
the built distributions attached, pushes the multi-arch Docker image,
and deploys the Sphinx docs
- Add docs.yml: reusable docs build/deploy to GitHub Pages, also
runnable on demand (workflow_dispatch) for documentation-only changes
between releases
- docker.yml: add a workflow_call trigger with a push_image input, since
a GitHub Release created with the workflow's own GITHUB_TOKEN emits no
`release: published` event; release.yml calls it directly instead
- Remove the legacy build.sh / publish-docs.sh manual process
- AGENTS.md: CRITICAL rule that releases require explicit maintainer
permission, plus docs for the new release flow and its one-time
repo/PyPI configuration prerequisites
- Bump the mailsuite floor to >=2.3.0 (raises the transitive mail-parser
floor to >=4.6.2 and cryptography to >=50.0.0)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
