Usage

Pin the action to a full commit SHA in your release workflow:

- uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

Then run, from the project root, on the Python the action uses:

python -m blueline dry-release --no-dry-run

blueline reads the pin from .github/workflows/release.yml, fetches the action’s Dockerfile and requirements/runtime.txt at that commit, and:

1. fails if it is not running on the action’s Python (the Dockerfile’s FROM python:X.Y);

2. installs twine into the running environment with pip, constrained to the action’s runtime pins;

3. builds an sdist and a wheel into a temporary directory;

4. runs twine check --strict on them.

Steps 2 and 3 change things, so, like other gather commands, they only run with --no-dry-run; without it, blueline fetches the action’s files, checks the Python version, and logs the commands it would run.

--workflow PATH reads the pin from another workflow file, and a positional argument builds a project other than the current directory.

Every command runs through gather’s runner. curl for the action’s files, the version check, and twine check are read-only and use safe_run; pip and build use run, which only runs them with --no-dry-run. Tests drive the whole command with a fake subprocess.run.

With nox

@nox.session(python="3.13")
def dry_release(session):
    session.install("blueline")
    session.run("python", "-m", "blueline", "dry-release", "--no-dry-run")

When the action moves to a new Python, blueline fails and says so: update python= and the CI job that runs the session.

blueline needs pip in the session’s environment, which nox’s default virtualenv backend provides. The uv backend is not supported. It also needs curl on PATH, which GitHub’s runners have.