[FEATURE](ci) Dual-publish to legacy and MCD CodeArtifact accounts

[John McCall (lowlydba)]

Context

Part of OvertureMaps/ops-team#466: schema, tf-data-platform, and places-quality-model need to dual-publish overture-pypi packages into both the legacy CodeArtifact account (505071440022) and the new MCD account (763944545891). OvertureMaps/omf-core-data-opentofu#91 already mirrors the domain into MCD and grants this repo a codeartifact-pypi-publish-oidc-overturemaps role there. Also supports #510 (Phase 4, vnext dev builds to CodeArtifact), which is blocked on the same underlying CodeArtifact migration and will need the same dual-publish wiring.

Change

main-publish.yaml's publish job splits into build and two independent publish-legacy/publish-mcd jobs, each calling OvertureMaps/workflows/.github/actions/uv-publish-to-codeartifact (OvertureMaps/workflows#97) against its own account. Neither blocks the other, and one package failing to build doesn't skip publishing the rest (if: success() || failure()).

build now uploads the wheel/sdist as an artifact for the publish jobs to download, and keeps the old inline check that the built filenames match the version compute-version computed, catching a stamp/build mismatch once instead of duplicating it per account.

A final are-we-good job (lowlydba/are-we-good) rolls both publish jobs into one required check, Main publish / are-we-good (create-check-run, to avoid colliding with other workflows' same-named jobs).

Version computation still queries the legacy account only, via setup-codeartifact (OvertureMaps/workflows#80). Both shared actions are pinned to @main.

Deletes the local .github/actions/code-artifact action (its other caller, reusable-check-python-package-versions.yaml, is migrated to setup-codeartifact too), and fixes every uses: ./... ref repo-wide to uses: $/..., since zizmor 1.30.0 now flags the old syntax.

Note

Branch protection tracking publish today should switch to Main publish / are-we-good.

Testing

The pull_request path exercises build's legacy read-only auth, version query, and filename check; the publish jobs and are-we-good are skipped there, same as before. zizmor is clean. The real dual-publish can only be verified once merged to main.

Fixes #725

[github-actions]

🗺️ Schema reference docs preview is live!

🌍 Preview	https://staging.overturemaps.org/schema/pr/726/schema/index.html
🕐 Updated	Sep 09, 2026 17:07 UTC
📝 Commit	9a154bb
🔧 env SCHEMA_PREVIEW	true

Note

♻️ This preview updates automatically with each push to this PR.

[Alex Iannicelli (atiannicelli)]

k

[Copilot]

🟡 Changes recommended

Multiple workflows/actions use uses: $/.github/..., which is not valid GitHub Actions syntax for local references and will prevent the workflows from parsing/running.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the release/publish GitHub Actions workflows to support dual-publishing Python packages to both the legacy and MCD AWS CodeArtifact accounts during migration, while also refactoring the main publish flow into build + independent publish jobs.

Changes:

• Split main-publish.yaml into build, publish-legacy, publish-mcd, and are-we-good jobs, and switch publishing to the shared uv-publish-to-codeartifact action.
• Migrate the version-collision check workflow from the local CodeArtifact composite action to setup-codeartifact, and delete the local .github/actions/code-artifact action.
• Replace local uses: ./.github/... references with uses: $/.github/... repo-wide.

File summaries

File	Description
.github/workflows/main-publish.yaml	Refactors main publish into build + dual publish jobs and adds an aggregator check.
.github/workflows/reusable-check-python-package-versions.yaml	Switches CodeArtifact auth to setup-codeartifact for version existence checks.
.github/workflows/check-python-package-versions.yaml	Updates caller to use the reusable workflow via the new local uses: syntax.
.github/workflows/release-trigger.yaml	Updates local composite action references to the new local uses: syntax.
.github/actions/detect-version-bumps/action.yml	Updates nested local action reference to the new local uses: syntax.
.github/actions/detect-affected-packages/action.yml	Updates nested local action reference to the new local uses: syntax.
.github/actions/compute-version/action.yml	Updates documentation to reference setup-codeartifact outputs for index URL.
.github/actions/code-artifact/action.yml	Deletes the legacy local CodeArtifact credential helper action.

Review details

Suppressed comments (3)

.github/workflows/main-publish.yaml:123

• uses: $/... is not valid GitHub Actions syntax for local actions/workflows; local references must use a relative path like ./.github/.... As written, this workflow will fail to parse/run.

      - name: Compute version
        id: compute
        uses: $/.github/actions/compute-version
        with:
          package: ${{ matrix.package }}

.github/workflows/release-trigger.yaml:122

• uses: $/... is not valid GitHub Actions syntax for local actions/workflows; local references must use a relative path like ./.github/.... As written, this workflow will fail to parse/run.

      - name: Create release
        uses: $/.github/actions/create-package-release
        with:
          package: ${{ matrix.package }}

.github/workflows/main-publish.yaml:197

• Because this job needs: build, it will be skipped entirely if any matrix leg in build fails (a matrix job's overall result is failure when any leg fails). That defeats the intent of letting one package failure not block publishing other packages. Consider making this job run regardless of build's conclusion so successful legs can still publish.

    name: Publish ${{ matrix.package }} to MCD CodeArtifact
    needs: [detect, build]
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest

• Files reviewed: 8/8 changed files
• Comments generated: 7
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Alex Iannicelli (atiannicelli)]

lgtm

[John McCall (lowlydba)]

Copilot resolve the merge conflicts in this pull request

[Copilot]

Copilot resolve the merge conflicts in this pull request

Merged main and resolved the workflow conflicts in merge commit 9a154bb.