0.29 release

[agriyakhetarpal]

It would be great if we could tag a release soon, with these PRs:

• Include version and checksum validation when updating packages #27
• Do not require downloading xbuildenv when updating package recipes #30
• Add a JSON output for pyodide xbuildenv search, better tabular output #28
• chore: convert all relative imports to absolute imports #29

Would you like to include #21, too, or leave that for another release, @ryanking13?

and we could resolve this issue, too, perhaps? It looks quite easy to do and would help the conda-forge folks serve better metadata.

• Update packaging URLs, etc? #11

I would probably leave out #14 for later, because it is slightly low priority for me to do (useful for some packages, but not a lot of packages)

I shall be available to help do the release – if it is needed of me to do so.

[ryanking13]

Sure, let's release 0.29 after resolving your open PRs. #21 would take some time, so it doesn't need to be included.

[ryanking13]

I shall be available to help do the release – if it is needed of me to do so.

Releasing pyodide-build is quite easy (it is a benefit of unvendoring things :) ); you just need to update the changelog, and create a tag. So feel free to make a release when it is ready.

[agriyakhetarpal]

Awesome! I'll do it this week when I am ready. Thanks for the help in getting all those PRs merged!

[agriyakhetarpal]

Also, would it be okay to switch to using GitHub Releases from tags, instead of just tags? This improves our security practices, because one needs permissions in the repository to create a GitHub Release instead of just being able to push a tag (side note: we should add some tag protection rules, if we haven't already). So, it would have the benefit of not triggering a PyPI release when a tag is pushed, so that we can use our trusted publishing better and make use of the GHA Attestations feature.

[ryanking13]

Also, would it be okay to switch to using GitHub Releases from tags, instead of just tags?

Sure, fine with me.

[agriyakhetarpal]

Tagged: https://github.com/pyodide/pyodide-build/releases/tag/v0.29.0
GHA release workflow run: https://github.com/pyodide/pyodide-build/actions/runs/10941566243

However, the upload failed – this is because I moved the publishing job(s) to another workflow file (they are now in a dedicated release.yml instead of main.yml). I don't have access to the project on PyPI, so could you re-add the trusted publishing configuration in the PyPI settings, @ryanking13? Alternatively, we can just rename the release workflow in the already present configuration. I've deleted the release for now, and will update the tag and release again once it is done.

[ryanking13]

@agriyakhetarpal I updated workflow file name in PyPI Trusted Publisher Management. Could you try rereleasing the package?

[agriyakhetarpal]

Thanks! This one worked: https://github.com/pyodide/pyodide-build/actions/runs/10942460921/job/30379546450

Available on PyPI: https://pypi.org/project/pyodide-build/0.29.0/

[agriyakhetarpal]

Thanks for the speedy reviews! We can close this now.