* ci: publish to PyPI on version tags
Add .github/workflows/publish.yml: pushing a PEP 440 tag (v0.3.0.dev2,
v0.3.0, v0.3.0rc1, …) derives the version from the tag, injects it into
pyproject.toml, builds, publishes to PyPI via OIDC trusted publishing
(no stored token), and creates a GitHub Release with generated notes.
Mirrors the OpenKnowledgeBase publish flow, but keeps poetry-core as the
build backend and injects the version in CI rather than switching to
VCS-driven versioning, so contributors' local builds are unaffected.
Requires one-time setup: a PyPI Trusted Publisher on the pageindex project
(repo VectifyAI/PageIndex, workflow publish.yml, environment pypi) and a
GitHub Environment named pypi.
Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS
* ci: bump publish workflow actions to Node 24 releases
checkout v4.1.7 -> v7.0.0, setup-python v5.2.0 -> v6.3.0,
action-gh-release v3.0.0 -> v3.0.1 (all Node 24, clearing the Node 20
deprecation warning). gh-action-pypi-publish is already latest (v1.14.0,
Docker-based). Refs stay pinned to commit SHAs.
Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS
Weekly scan to open PRs upgrading third-party actions used in CI.
pip dependencies remain pinned and are covered by Dependabot security
updates separately.
Issues are opened by external users who don't have write permissions.
Add allowed_non_write_users: "*" so claude-code-action runs for all
issue authors, not just repo collaborators.
Backfill workflow triggers issue-dedupe via gh workflow run, which
makes the actor github-actions. Add it to allowed_bots so
claude-code-action accepts the trigger.
- Only retry 403 when rate-limit headers indicate throttling, not permission errors
- Add fetchAllComments() with pagination for issues with 100+ comments
- Add pagination loop in backfill workflow to handle repos with 200+ open issues
Replace the copilot-generated inline search logic with a claude-code-action
based architecture inspired by anthropic/claude-code's approach:
- Add .claude/commands/dedupe.md with 5-parallel-search strategy
- Add scripts/comment-on-duplicates.sh with 3-day grace period warning
- Rewrite issue-dedupe.yml to use claude-code-action + /dedupe command
- Rewrite autoclose script to check bot comments, human activity, and thumbsdown
- Rewrite backfill to trigger dedupe workflow per issue with rate limiting
- Add concurrency control, timeout, input validation, and rate limit retry
- Remove gh.sh (unnecessary), backfill-dedupe.js (replaced by workflow trigger)
