ci: exempt first-party packages from the Safe Chain age gate in CD - #1062
Merged
Conversation
tudormatei1
marked this pull request as ready for review
September 2, 2026 11:29
`lint.yml`, `test.yml` and `publish-dev.yml` all set SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS, but `cd.yml` never got it, and CD builds in its own inline job. The post-merge run for 0.16.15 resolved fine and then died downloading uipath-langchain-client 1.18.3, published an hour earlier, so the release did not reach PyPI. Skips only the age gate; malware scanning and the other Safe Chain checks still run. The list is copied from the other three workflows unchanged.
tudormatei1
force-pushed
the
fix/cd-safe-chain-age-gate
branch
from
September 2, 2026 11:29
1f3f877 to
fd9a65f
Compare
There was a problem hiding this comment.
🟢 Approval recommended
The change is a minimal, consistent workflow-level env addition that aligns CD with existing CI workflows and directly addresses the described Safe Chain gate failure.
Pull request overview
Adds the Safe Chain “minimum package age” gate exclusion list to the CD workflow so first-party packages (including uipath-langchain-client) are exempted during the CD build/publish path, matching the existing configuration in lint.yml, test.yml, and publish-dev.yml.
Changes:
- Define
SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONSat the workflow level in.github/workflows/cd.ymlso it applies to the inlinebuildjob (whereuv syncruns). - Keep the exclusion list identical to other workflows to avoid drift and ensure consistent Safe Chain behavior across CI/CD.
File summaries
| File | Description |
|---|---|
| .github/workflows/cd.yml | Adds the Safe Chain minimum-package-age exclusions env var so CD’s inline build step can download newly-published first-party deps without tripping the age gate. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
radu-mocanu
approved these changes
Sep 2, 2026
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
uipath-langchain0.16.15 did not reach PyPI. The post-merge CD run resolved its dependencies fine and then failed downloadinguipath-langchain-client1.18.3, published an hour earlier, with a Safe Chain 403 on the minimum-package-age gate.lint.yml,test.ymlandpublish-dev.ymlalready setSAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS, and the list in all three already namesuipath-langchain-client.cd.ymlnever got it, and CD builds in its own inline job rather than through those workflows, which is why thelintjob passed andbuilddied. This adds the same line, unchanged, at workflow level.The
[tool.uv.exclude-newer-package]exemption inpyproject.tomlcovers a different gate: it governs which version uv resolves, not whether the download is allowed. Resolution succeeded here, so that exemption was already doing its job.Skips only the age gate. Malware scanning and every other Safe Chain check still run, which is the least-disabling override the supply-chain-guard runbook asks for before reaching for
SCG_KILL_SWITCH.uipath-python hit this exact split in #1858 and #1861: the first PR added the variable to lint and test, the second had to follow up because the CD path built through a workflow that never got it.
Merging this does not republish on its own, since CD triggers on pushes that touch
pyproject.toml. 0.16.15 needs a manual run of the CD workflow againstmainafterwards.