0.3.2 #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to PyPI | |
| # Publishes presidio-evaluator to PyPI when a GitHub Release is published. | |
| # Uses PyPI Trusted Publishing (OIDC) — no API tokens are stored. | |
| # | |
| # One-time PyPI setup (by a project owner of `presidio-evaluator`): | |
| # PyPI project -> Settings -> Publishing -> Add a trusted publisher (GitHub Actions): | |
| # Owner: data-privacy-stack | |
| # Repository: presidio-research | |
| # Workflow name: publish.yml | |
| # Environment: pypi | |
| # | |
| # To release: bump `version` in pyproject.toml, then publish a GitHub Release | |
| # whose tag matches (e.g. tag `0.3`). | |
| on: | |
| release: | |
| types: [published] | |
| # Least-privilege default for all jobs; the publish job widens this for OIDC. | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| name: Build distributions | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # full history needed to check the tag is on main | |
| - name: Verify release tag matches pyproject version | |
| run: | | |
| set -euo pipefail | |
| version=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])") | |
| tag="${GITHUB_REF_NAME#v}" | |
| if [ "$tag" != "$version" ]; then | |
| echo "::error::Release tag '$GITHUB_REF_NAME' does not match pyproject version '$version'." | |
| exit 1 | |
| fi | |
| echo "Release tag matches pyproject version ($version)." | |
| - name: Verify release commit is contained in main | |
| run: | | |
| set -euo pipefail | |
| git fetch --quiet origin main | |
| if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then | |
| echo "::error::Release commit $GITHUB_SHA is not contained in main; refusing to publish." | |
| exit 1 | |
| fi | |
| echo "Release commit is contained in main." | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| - name: Build sdist and wheel | |
| run: uv build | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist | |
| path: dist/ | |
| publish: | |
| name: Publish to PyPI | |
| needs: build | |
| runs-on: ubuntu-latest | |
| environment: pypi | |
| permissions: | |
| contents: read | |
| id-token: write # required for trusted publishing (OIDC) | |
| steps: | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: dist | |
| path: dist/ | |
| - name: Publish to PyPI | |
| uses: pypa/gh-action-pypi-publish@release/v1 |