[cuevaio]

Python CI built core and desktop wheels, a source distribution and installed-viewer integration across Linux, both Mac architectures and Windows on every PR/main push. Keep package metadata/version checks automatic; run the build matrices on existing python-v* release tags or explicit manual dispatch. Installed-viewer qualification still depends on both native wheel matrices.

The observed week includes about 136 runner minutes in this PR workflow. All packaging commands, platform matrices, ordinary Rust/browser CI and the existing tag-only PyPI publication condition/environment remain unchanged. Manual qualification cannot publish. Updated contributor rules require local checks and full release qualification before publishing.

Validation also passed the source-distribution packaging test.

Measured against October 28–November 3 workflow job timestamps across 119 accessible repositories. These are runner-time observations, not live billed amounts or a monthly savings forecast. The November 1–2 billing export and detailed workflow inventory are retained locally. No deployment, publication, billing setting or required branch protection was changed.

Validation: actionlint and whitespace checks pass. Parsed the actual YAML and exercised the changed tag/manual gates across 48 event cases across this sweep; job commands and platform matrices are preserved, and adjacent workflows are byte-identical. Independent review found no actionable issues at the committed head. Heavy release qualification was not dispatched for these workflow changes.

Linear: https://linear.app/atomic-strata/issue/ATO-2261/reduce-github-actions-costs

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T21:00:21.152928Z	b3b96b1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The Python workflow now limits the wheels, sdist, and desktop jobs to manual dispatches or python-v tags. Contributor guidance describes the hosted-build schedule, local checks, release qualification, and publication process.

Changes: Python build gating

Layer / File(s)	Summary
Gate Python build jobs and document the workflow .github/workflows/python.yml, AGENTS.md	The wheels, sdist, and desktop jobs now run only for manual dispatches or refs beginning with refs/tags/python-v. Contributor guidance distinguishes PR checks from hosted Python builds and describes local checks, release qualification, and tag-only approved PyPI publication.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: bregydoc

Merge Risk: Minimal · up to b3b96

The workflow preserves ordinary checks while limiting hosted build matrices to release tags or manual qualification, with no established merge-blocking issue.

Security architecture risk: Minimal · up to b3b96

Build scheduling changes, but release validation and publishing permissions remain intact. Manual qualification cannot publish, and no material security risk introduced by this change was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The security-relevant downstream outcome remains publication of the desktop companion and core Python distributions. The added conditions restrict build execution and do not add a new route to this publishing authority.

Trust Boundaries and Controls

• inferred — PR-controlled source cannot reach the publisher through an ordinary PR run, and manual dispatch alone cannot satisfy its push-event condition. Publication still requires a Python-version tag push and successful qualification dependencies. The source declares the pypi environment but does not establish whether reviewers are configured.

Resilience and Maintainability Implications

• inferred — Ref-scoped cancellation and sequential companion-then-core publication are unchanged. An interruption between uploads can leave a partially published release; this pre-existing non-atomic transition is not introduced or expanded by the new build gates. The PR adds no recovery or rerun behavior.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "Build Python platform wheels only for releases or manual qualification" matches the main change. The workflow file python.yml now runs the wheels, sdist, and desktop jobs only for workflow_…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "Build Python platform wheels only for releases or manual qualification" matches the main change. The workflow file python.yml now runs the wheels, sdist, and desktop jobs only for workflow_dispatch events or refs beginning with refs/tags/python-v. The PR objectives state the same goal: Python platform build matrices run only for python-v* release tags or manual dispatches. The title is concise, specific, and does not use vague terms. It does not mention the AGENTS.md documentation update or the sdist and desktop jobs, but it does not need to cover every detail.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 466d4b5e-4cd9-4cc7-8a7c-08a96024b904

Commits

Reviewing files that changed from the base of the PR and between ecb3017 and b3b96b1.

Files selected for processing: 2

• .github/workflows/python.yml
• AGENTS.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

[cuevaio]

Linear: ATO-2261 Reduce GitHub Actions costs