ci: Add a new step to update pyln versions out of WORKDIR
What changed, and why it matters
This is a routine fix to the project's automated package-publishing workflow. The change moves a version-update step so it runs from the correct directory before publishing Python packages. There is no security-relevant change and no indication of a vulnerability.
No security action needed. Treat as a normal CI maintenance commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies .github/workflows/pypi.yml. It extracts the make update-pyln-versions step out of the ‘Publish distribution’ job’s run block (which executed inside WORKDIR) into a separate workflow step that runs from the repository root. The publish step no longer changes into WORKDIR or runs the version update. This is a CI/CD correctness fix for an invalid working-directory context during PyPI publishing.
Changed components
.github/workflows/pypi.ymlInspect captured patch +7 / −4
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index 3ab33513..7008297b 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -67,6 +67,13 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - name: Update pyln versions
+ id: update-versions
+ run: |
+ export VERSION=$(git describe --tags --abbrev=0)
+ echo "Pyln VERSION: $VERSION"
+ make update-pyln-versions NEW_VERSION=$VERSION
+
- name: Publish distribution 📦 to Test PyPI
if: github.repository == 'ElementsProject/lightning' && steps.set-values.outputs.DISTLOCATION == 'test'
env:
@@ -84,10 +91,6 @@ jobs:
WORKDIR: ${{ matrix.WORKDIR }}
run: |
echo "UV VERSION PUBLISH: $(uv --version)"
- cd ${{ env.WORKDIR }}
- export VERSION=$(git describe --tags --abbrev=0)
echo "Pyln VERSION: $VERSION"
- make update-pyln-versions NEW_VERSION=$VERSION
- cd /github/workspace
uv build --package ${{ matrix.PACKAGE }}
uv publish
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.