fix(packaging): bundle LICENSE in wheel and sdist#1354
Merged
mergify[bot] merged 1 commit intomainfrom May 5, 2026
Merged
Conversation
The 2026.5.5.1 release upload to PyPI failed with ``400 License-File LICENSE does not exist in distribution file mergify_cli-2026.5.5.1.tar.gz at mergify_cli-2026.5.5.1/LICENSE``. Maturin auto-derives a ``License-File: LICENSE`` PEP 639 metadata field from ``license = "Apache-2.0"`` plus the project root ``LICENSE`` file, but the sdist tarball (``maturin sdist``) packs the cargo workspace and the Python source dir without picking up the project root ``LICENSE`` itself. PyPI's upload validator cross-checks the metadata against the tarball contents and 400s when they disagree. Listing ``LICENSE`` in ``[tool.maturin].include`` puts it back in both the wheel and the sdist, so the metadata claim is honored and PyPI accepts the upload. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Change-Id: Ie45717750af52467929600966592cb8453d3b4d2
Member
Author
|
This pull request is part of a Mergify stack:
|
This was referenced May 5, 2026
Contributor
Merge ProtectionsYour pull request matches the following merge protections and will not be merged until they are valid. 🟢 🤖 Continuous IntegrationWonderful, this rule succeeded.
🟢 👀 Review RequirementsWonderful, this rule succeeded.
🟢 Enforce conventional commitWonderful, this rule succeeded.Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
🟢 🔎 ReviewsWonderful, this rule succeeded.
🟢 📕 PR descriptionWonderful, this rule succeeded.
|
There was a problem hiding this comment.
Pull request overview
This PR updates Python packaging configuration so the generated distributions include the repository LICENSE, matching the PEP 639 metadata that maturin derives and preventing PyPI release uploads from being rejected.
Changes:
- Add
LICENSEto[tool.maturin].includeinpyproject.toml. - Document why the license file must be bundled in both wheel and sdist artifacts.
- Align package contents with the
License-File: LICENSEmetadata expected by PyPI.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
kozlek
approved these changes
May 5, 2026
JulianMaurin
approved these changes
May 5, 2026
sileht
approved these changes
May 5, 2026
Contributor
Merge Queue Status
This pull request spent 15 seconds in the queue, including 3 seconds running CI. Required conditions to merge
|
mergify
Bot
deleted the
devs/jd/worktree-rust-port/bundle-license-wheel-sdist--e4571775
branch
This was referenced May 5, 2026
38 tasks
mergify Bot
pushed a commit
that referenced
this pull request
May 5, 2026
…1355) Without this, packaging-metadata bugs only surface at ``release: published`` time — release 2026.5.5.1 was rejected by PyPI's upload validator with ``400 License-File LICENSE does not exist in distribution file`` because the LICENSE auto-bundling hadn't been wired up. PR CI couldn't have caught it: ``build-sdist`` was gated on ``inputs.stamp-version``, so PR runs skipped the sdist entirely, and there was no twine invocation anywhere. Two changes: 1. ``build-sdist`` now runs on every PR. The version-stamping step and the artifact upload still gate on ``inputs.stamp-version`` (PR builds keep the placeholder version and skip the upload — the artifact is only useful for the publish job in ``release.yml``). The Python toolchain is provisioned the same way as the wheel jobs. 2. ``twine check --strict`` runs against both the wheel (per matrix target) and the sdist immediately after each is built. Strict mode applies the same metadata rules PyPI's upload validator does — README rendering, ``Description-Content-Type``, ``License-File`` presence — so a mismatch fails PR CI instead of the next release. The cost is one extra ubuntu-24.04 job (~30s for sdist + twine check) and a few seconds per wheel-matrix shard for the twine install + check. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Depends-On: #1354
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 2026.5.5.1 release upload to PyPI failed with
400 License-File LICENSE does not exist in distribution file mergify_cli-2026.5.5.1.tar.gz at mergify_cli-2026.5.5.1/LICENSE.Maturin auto-derives a
License-File: LICENSEPEP 639 metadatafield from
license = "Apache-2.0"plus the project rootLICENSEfile, but the sdist tarball (maturin sdist) packsthe cargo workspace and the Python source dir without picking up
the project root
LICENSEitself. PyPI's upload validatorcross-checks the metadata against the tarball contents and 400s
when they disagree.
Listing
LICENSEin[tool.maturin].includeputs it back inboth the wheel and the sdist, so the metadata claim is honored and
PyPI accepts the upload.
Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com