[CHORE](ci) Point version-check workflow at MCD CodeArtifact by lowlydba · Pull Request #747 · OvertureMaps/schema

John McCall (lowlydba) · 2026-09-14T18:18:57Z

Context

Part of the OvertureMaps/ops-team#520 MCD CodeArtifact cutover. #745 tracks this repo's full cutover; the legacy publish-step removal there stays blocked until consumers are confirmed off legacy. This PR only lands the version-check workflow's account default flip, which doesn't touch main-publish.yaml's dual-publish behavior.

Change

reusable-check-python-package-versions.yaml's aws_account_id/aws_iam_role_name defaults move from legacy (505071440022, GithubActions_Schema_CodeArtifact_ReadOnly) to MCD (763944545891, codeartifact-pypi-readonly-oidc-overturemaps).

That role is a dedicated read-only role added in OvertureMaps/omf-core-data-opentofu#120 (now merged), scoped to GetAuthorizationToken/GetRepositoryEndpoint/ReadFromRepository only, closing OvertureMaps/ops-team#521. It replaces an earlier draft of this PR that reused the publish-capable role, which Copilot's review correctly flagged as risky for a pull_request-triggered check.

Testing

I added a temporary version bump commit on this branch to trigger the modified CI workflow, and it ran successfully: https://github.com/OvertureMaps/schema/actions/runs/34978920990/job/104413801496?pr=747

The commit has been reverted ✅

Fixes #746

github-actions · 2026-09-14T18:22:33Z

🗺️ Schema reference docs preview is live!


🌍 Preview	https://staging.overturemaps.org/schema/pr/747/schema/index.html
🕐 Updated	Sep 16, 2026 13:24 UTC
📝 Commit	2f21737
🔧 env SCHEMA_PREVIEW	`true`

Note

♻️ This preview updates automatically with each push to this PR.

Copilot

🟡 Changes recommended

Use a read-only role or otherwise prevent untrusted pull requests from assuming the publish-capable role.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates the reusable package-version check workflow to use MCD CodeArtifact defaults.

Changes:

Switches the default AWS account to MCD.
Switches the default IAM role to the MCD CodeArtifact publish role.
Leaves publishing workflow behavior unchanged.

File summaries

File	Summary
`.github/workflows/reusable-check-python-package-versions.yaml`	Updates CodeArtifact defaults. The publish-capable role creates a critical security concern for pull-request workflows.

Review details

Files reviewed: 1/1 changed files
Comments generated: 1
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Francisco Jiménez (jjcfrancisco)

Lgtm

Victor Schappert (vcschapp) · 2026-09-16T03:57:44Z

John McCall (@lowlydba) I'm unable to merge b/c of DCO checks failing on two commits, cea02b2 (Revert "chore: exercise changed CI workflow") and adede8f (Revert "test commit"). ... Other than that it's ready to go!

Francisco Jiménez (jjcfrancisco)

Thanks for this!

Flips reusable-check-python-package-versions.yaml's aws_account_id/ aws_iam_role_name defaults from legacy CodeArtifact to MCD, reusing codeartifact-pypi-publish-oidc-overturemaps: MCD has no dedicated read-only role and won't get one, but the publish role already grants codeartifact:ReadFromRepository and its OIDC trust policy allows pull_request-context assumption in this repo. Closes #746 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org>

Signed-off-by: John McCall <john@overturemaps.org>

This reverts commit 0a5f376. Signed-off-by: John McCall <john@overturemaps.org>

Signed-off-by: John McCall <john@overturemaps.org>

This reverts commit eed4eaa. Signed-off-by: John McCall <john@overturemaps.org>

# Description Removes the legacy CodeArtifact publish leg from `main-publish.yaml` so internal builds publish to the MCD account only. The pypi consumer cutover (OvertureMaps/ops-team#520) is complete, so the dual-publish groundwork from OvertureMaps/ops-team#466 is no longer needed. Beyond the `publish-legacy` job itself, `ca-legacy`'s CodeArtifact credentials also fed the `compute-version` step's index lookup. Removing `ca-legacy` outright would have broken version computation, so this replaces it with an equivalent `ca-mcd` step: the existing dedicated MCD read-only role for the PR smoke test, and the existing MCD publish role for real pushes (same pattern already proven in #747). Closes #767 # Reference 1. OvertureMaps/ops-team#562 2. OvertureMaps/ops-team#520 3. #747 # Testing `main-publish.yaml` also runs read-only on any PR that touches itself, as a smoke test for this exact wiring. On this PR, `Detect affected packages (test)`, every per-package `Build <package> (test)` job, and `Are we good?` all passed, confirming `compute-version` resolves correctly against the new `ca-mcd` step. # Checklist 1. [ ] Add relevant examples. 2. [ ] Add relevant counterexamples. 3. [ ] Update any counterexamples that became obsolete. For example, if a counterexample uses property `A` but is not intended to test property `A`'s validity, and you made a schema change that invalidates property `A` in that counterexample, fix the counterexample to align it with your schema change. 4. [ ] Update in-schema documentation using plain English written in complete sentences, if an update is required. 5. [ ] Update Docusaurus documentation, if an update is required. 6. [ ] Review change with Overture technical writer to ensure any advanced documentation needs will be taken care of, unless the change is trivial and would not affect the documentation. > [!NOTE] > This is a CI-only workflow change with no schema content, so the checklist above doesn't apply. # Documentation website [Docs preview for this PR.](https://dfhx9f55j8eg5.cloudfront.net/pr/768)  --------- Signed-off-by: John McCall <john@overturemaps.org>

John McCall (lowlydba) mentioned this pull request Sep 14, 2026

[CHORE](ci) Flip version-check workflow to MCD CodeArtifact #748

Closed

John McCall (lowlydba) had a problem deploying to staging September 14, 2026 18:20 — with GitHub Actions Error

John McCall (lowlydba) force-pushed the lowlydba-cutover-pypi-consumers-to-codeartifact branch from b8f550d to 2428234 Compare September 14, 2026 18:20

John McCall (lowlydba) changed the title ~~[CHORE](ci) Point version-check workflow at MCD CodeArtifact~~ [CHORE](ci) Note pending MCD flip in version-check workflow Sep 14, 2026

John McCall (lowlydba) deployed to staging September 14, 2026 18:21 — with GitHub Actions View deployment

John McCall (lowlydba) force-pushed the lowlydba-cutover-pypi-consumers-to-codeartifact branch from 2428234 to 7983297 Compare September 14, 2026 18:22

John McCall (lowlydba) changed the title ~~[CHORE](ci) Note pending MCD flip in version-check workflow~~ [CHORE](ci) Point version-check workflow at MCD CodeArtifact Sep 14, 2026

John McCall (lowlydba) deployed to staging September 14, 2026 18:24 — with GitHub Actions View deployment

John McCall (lowlydba) force-pushed the lowlydba-cutover-pypi-consumers-to-codeartifact branch from 7983297 to 89c14df Compare September 14, 2026 19:57

John McCall (lowlydba) deployed to staging September 14, 2026 19:58 — with GitHub Actions View deployment

John McCall (lowlydba) added the change type - cosmetic 🌹 Cosmetic change label Sep 14, 2026

John McCall (lowlydba) marked this pull request as ready for review September 14, 2026 20:42

John McCall (lowlydba) requested a review from a team as a code owner September 14, 2026 20:42

Copilot AI lite review requested due to automatic review settings September 14, 2026 20:42

Copilot started reviewing on behalf of John McCall (lowlydba) September 14, 2026 20:43 View session

Copilot AI reviewed Sep 14, 2026

View reviewed changes

Comment thread .github/workflows/reusable-check-python-package-versions.yaml Outdated

John McCall (lowlydba) mentioned this pull request Sep 14, 2026

[CloudOps Support Request] Add read-only CodeArtifact IAM role in MCD account #749

Closed

Francisco Jiménez (jjcfrancisco) previously approved these changes Sep 15, 2026

View reviewed changes

John McCall (lowlydba) dismissed Francisco Jiménez (jjcfrancisco)’s stale review via 695d3f2 September 15, 2026 13:48

John McCall (lowlydba) force-pushed the lowlydba-cutover-pypi-consumers-to-codeartifact branch from 89c14df to 695d3f2 Compare September 15, 2026 13:48

John McCall (lowlydba) deployed to staging September 15, 2026 13:49 — with GitHub Actions View deployment

John McCall (lowlydba) requested a review from Francisco Jiménez (jjcfrancisco) September 15, 2026 13:57

John McCall (lowlydba) deployed to staging September 15, 2026 14:04 — with GitHub Actions View deployment

John McCall (lowlydba) requested a review from Seth Fitzsimmons (sethfitz) September 15, 2026 14:13

Seth Fitzsimmons (sethfitz) previously approved these changes Sep 15, 2026

View reviewed changes

John McCall (lowlydba) requested a review from Victor Schappert (vcschapp) September 15, 2026 19:39

Victor Schappert (vcschapp) force-pushed the lowlydba-cutover-pypi-consumers-to-codeartifact branch from 93e3e94 to f014a46 Compare September 16, 2026 03:43

Victor Schappert (vcschapp) previously approved these changes Sep 16, 2026

View reviewed changes

Victor Schappert (vcschapp) had a problem deploying to staging September 16, 2026 03:44 — with GitHub Actions Error

Victor Schappert (vcschapp) force-pushed the lowlydba-cutover-pypi-consumers-to-codeartifact branch from f014a46 to 8f0db21 Compare September 16, 2026 03:45

Victor Schappert (vcschapp) deployed to staging September 16, 2026 03:46 — with GitHub Actions View deployment

Victor Schappert (vcschapp) force-pushed the lowlydba-cutover-pypi-consumers-to-codeartifact branch from 8f0db21 to adede8f Compare September 16, 2026 03:50

Victor Schappert (vcschapp) deployed to staging September 16, 2026 03:51 — with GitHub Actions View deployment

Francisco Jiménez (jjcfrancisco) previously approved these changes Sep 16, 2026

View reviewed changes

John McCall (lowlydba) added 5 commits September 16, 2026 09:22

chore: exercise changed CI workflow

d3dc121

Signed-off-by: John McCall <john@overturemaps.org>

Revert "chore: exercise changed CI workflow"

8468e26

This reverts commit 0a5f376. Signed-off-by: John McCall <john@overturemaps.org>

test commit

09b872a

Signed-off-by: John McCall <john@overturemaps.org>

Revert "test commit"

4eb246a

This reverts commit eed4eaa. Signed-off-by: John McCall <john@overturemaps.org>

John McCall (lowlydba) dismissed stale reviews from Francisco Jiménez (jjcfrancisco), Seth Fitzsimmons (sethfitz), and Victor Schappert (vcschapp) via 4eb246a September 16, 2026 13:22

John McCall (lowlydba) force-pushed the lowlydba-cutover-pypi-consumers-to-codeartifact branch from adede8f to 4eb246a Compare September 16, 2026 13:22

Merge branch 'main' into lowlydba-cutover-pypi-consumers-to-codeartifact

2f21737

John McCall (lowlydba) deployed to staging September 16, 2026 13:23 — with GitHub Actions View deployment

John McCall (lowlydba) requested review from Francisco Jiménez (jjcfrancisco), Seth Fitzsimmons (sethfitz) and Victor Schappert (vcschapp) September 16, 2026 14:12

Seth Fitzsimmons (sethfitz) approved these changes Sep 16, 2026

View reviewed changes

Francisco Jiménez (jjcfrancisco) approved these changes Sep 16, 2026

View reviewed changes

John McCall (lowlydba) merged commit e074163 into main Sep 16, 2026
27 checks passed

John McCall (lowlydba) deleted the lowlydba-cutover-pypi-consumers-to-codeartifact branch September 16, 2026 14:37

John McCall (lowlydba) mentioned this pull request Sep 30, 2026

[CHORE](ci) Remove legacy CodeArtifact publish step #768

Merged

6 tasks

Navigation Menu

Repository navigation

[CHORE](ci) Point version-check workflow at MCD CodeArtifact - #747

[CHORE](ci) Point version-check workflow at MCD CodeArtifact#747
John McCall (lowlydba) merged 6 commits into
mainfrom
lowlydba-cutover-pypi-consumers-to-codeartifact

John McCall (lowlydba) commented Sep 14, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Francisco Jiménez (jjcfrancisco) left a comment

Uh oh!

Victor Schappert (vcschapp) commented Sep 16, 2026

Uh oh!

Francisco Jiménez (jjcfrancisco) left a comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

John McCall (lowlydba) commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Change

Testing

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🗺️ Schema reference docs preview is live!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Francisco Jiménez (jjcfrancisco) left a comment

Choose a reason for hiding this comment

Uh oh!

Victor Schappert (vcschapp) commented Sep 16, 2026

Uh oh!

Francisco Jiménez (jjcfrancisco) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

John McCall (lowlydba) commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading