microsoft / microsoft/webui

Publish the microsoft-webui Python package to PyPI

Open
#456 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
90
Forks
23
Avg merge
13h 14m
Merged PRs (30d)
68

Description

PR #453 adds the microsoft-webui Python package and builds all six cp311-abi3 wheels plus an sdist, attaching them to each GitHub Release. It deliberately does not publish them to PyPI.

Publishing was descoped because the ESRP and package-ownership policy for a Microsoft-owned PyPI project is unsettled. The build side is already done and validated, so this issue tracks only the publication step.

Prerequisites
  • Decide the ESRP / signing policy for PyPI artifacts published under a Microsoft-owned account.
  • Register and claim the microsoft-webui project on PyPI, and confirm the approved owner/co-owner accounts.
  • Configure a PyPI Trusted Publisher for microsoft/webui, the publishing workflow file, and a protected pypi GitHub environment.
  • Do the same on TestPyPI and perform a publish/install rehearsal before the first real release.
Implementation
  • Add a workflow that publishes the exact release assets with OIDC Trusted Publishing, triggered by the GitHub Release published event.
  • Validate the assets before upload rather than rebuilding them, so what ships is what the release pipeline already tested.
  • Update docs/guide/integrations/python.md, docs/guide/installation.md, README.md, and crates/webui-python/README.md, which currently tell users to install from a release asset instead of pip install microsoft-webui.
  • Update the Python distribution section of DESIGN.md, which records that WebUI does not publish to PyPI.
Notes

An earlier iteration of #453 contained a full OIDC publish workflow with provenance manifests and digest re-validation. It was removed rather than merged unused; the PR history has it if it is useful as a starting point.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the prerequisites for ESRP, signing, ownership, and protected environments, then inspect the removed workflow in PR #453. Check the release assets and the TestPyPI rehearsal before adding publication support. Done means approved ownership and policy, a validated OIDC workflow, and updated guidance in the four listed documentation files plus DESIGN.md.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, python
Domain
ci-cd, documentation, release
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.