sigstore-models/.github/workflows/publish.yml at main · astral-sh/sigstore-models · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
name: Publish

on:
  release:
    types: [published]

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

permissions: {}

jobs:
  pypi:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    permissions:
      id-token: write # for PyPI trusted publishing + attestations

    environment:
      name: pypi.org
      url: https://pypi.org/p/sigstore-models

    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4

      - name: Build
        run: uv build

      - name: Attest
        uses: astral-sh/attest-action@2c727738cea36d6c97dd85eb133ea0e0e8fe754b # v0.0.4

      - name: Publish to PyPI
        run: |
          uv publish --trusted-publishing=always dist/*