Merge pull request #108 from bsweger/dependabot/github_actions/gha-up… #60
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # .github/workflows/publish-pypi.yml | |
| # uses trusted publishing to publish the package to PyPI and create a GitHub | |
| # release as described here: | |
| # https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ | |
| name: Publish to TestPyPI and PyPI and create GitHub release | |
| on: | |
| push: | |
| tags: | |
| # only run workflow for tags in release format | |
| - "v[0-9]+.[0-9]+.[0-9]+" | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| name: Build distribution 📦 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout 🛎️ | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Python 🐍 | |
| uses: actions/setup-python@v6 | |
| - name: Install uv 🌟 | |
| uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b #v7.2.0 | |
| with: | |
| version: "0.9.16" | |
| - name: Build package for distribution 🛠️ | |
| run: | | |
| uv build | |
| - name: Upload distribution packages 📤 | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: package-distribution | |
| path: dist/ | |
| publish-to-pypi: | |
| name: Publish Python distribution to PyPI | |
| # publish only on tag pushes that aren't part of a scheduled workflow run | |
| if: startsWith(github.ref, 'refs/tags/') && github.event_name != 'schedule' | |
| needs: | |
| - build | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: pypi | |
| url: https://pypi.org/p/pyprefab | |
| permissions: | |
| id-token: write # needed for trusted publishing (i.e., OIDC) | |
| steps: | |
| - name: Download distribution artifacts 📥 | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: package-distribution | |
| path: dist/ | |
| - name: Publish distribution to PyPI 🚀 | |
| uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e #v1.13.0 | |
| github-release: | |
| name: >- | |
| Sign the Python distributions with Sigstore | |
| and upload them to GitHub Release | |
| needs: | |
| - publish-to-pypi | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # required for creating GitHub Releases | |
| id-token: write # required for sigstore | |
| steps: | |
| - name: Download distribution artifacts 📥 | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: package-distribution | |
| path: dist/ | |
| - name: Sign the dists with Sigstore 📝 | |
| uses: sigstore/gh-action-sigstore-python@a5caf349bc536fbef3668a10ed7f5cd309a4b53d #v3.2.0 | |
| with: | |
| inputs: >- | |
| ./dist/*.tar.gz | |
| ./dist/*.whl | |
| - name: Create GitHub Release 🛠️ | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: >- | |
| gh release create | |
| "$GITHUB_REF_NAME" | |
| --repo "$GITHUB_REPOSITORY" | |
| - name: Upload artifact signatures to GitHub Release 📤 | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| # Upload to GitHub Release. | |
| # `dist/` contains the built packages, and the | |
| # sigstore-produced signatures and certificates. | |
| run: >- | |
| gh release upload | |
| "$GITHUB_REF_NAME" dist/** | |
| --repo "$GITHUB_REPOSITORY" | |
| publish-to-testpypi: | |
| name: Publish Python distribution to test PyPI | |
| needs: | |
| - build | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: pypi-test | |
| url: https://test.pypi.org/p/pyprefab | |
| permissions: | |
| id-token: write # needed for trusted publishing (i.e., OIDC) | |
| steps: | |
| - name: Download distribution artifacts 📥 | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: package-distribution | |
| path: dist/ | |
| - name: Publish distribution to test PyPI 🚀 | |
| uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e #v1.13.0 | |
| with: | |
| repository-url: https://test.pypi.org/legacy/ |