From 38dc0cb71f5cf80f299e99805d1f478af027cbe2 Mon Sep 17 00:00:00 2001 From: Richard Abrich Date: Fri, 28 Aug 2026 04:14:29 -0400 Subject: [PATCH] fix(release): install PyYAML before the claims registry gate Both release jobs run scripts/validate_claims.py, which imports yaml. Neither job installed PyYAML, so the step raised ModuleNotFoundError and exited 1 before a tag could be created or an artifact published. Install "pyyaml>=6" ahead of each claims step, matching the gate in validate-claims.yml. The validator needs only PyYAML plus stdlib, so a targeted install keeps the release path free of heavy dependencies. release.yml carries a reviewed SHA-256 in public-artifacts.json; the regenerated inventory is included. --- .github/workflows/release.yml | 12 ++++++++++++ public-artifacts.json | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 98843a8f..c46ef918 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -142,6 +142,12 @@ jobs: --wait-seconds 2700 \ --poll-seconds 10 + # The validator needs only PyYAML + stdlib (no package install, no + # browser), matching the gate in validate-claims.yml. Installing the + # whole package here would let a heavy dependency break the release. + - name: Install PyYAML + run: pip install "pyyaml>=6" + - name: Verify the claims registry run: python scripts/validate_claims.py --check --structure-only @@ -282,6 +288,12 @@ jobs: --repository "${GITHUB_REPOSITORY}" \ --sha "${GITHUB_SHA}" + # The validator needs only PyYAML + stdlib (no package install, no + # browser), matching the gate in validate-claims.yml. Installing the + # whole package here would let a heavy dependency break the release. + - name: Install PyYAML + run: pip install "pyyaml>=6" + - name: Verify the claims registry run: python scripts/validate_claims.py --check --structure-only diff --git a/public-artifacts.json b/public-artifacts.json index 5711ee57..1872911b 100644 --- a/public-artifacts.json +++ b/public-artifacts.json @@ -121,7 +121,7 @@ }, { "path": ".github/workflows/release.yml", - "sha256": "2e9f30a2a2d902950423513eb49ce76c63eed958a7f6b22e318826e7282f74aa" + "sha256": "d8f1207dc1976a9d9e07622c2cc528687a07e0a3dddc23e512c40ceefc03154d" }, { "path": ".github/workflows/validate-claims.yml",