WIP

Author: glenn20

.github/workflows/ci-workflow.yaml

@@ -1,18 +1,12 @@
 name: CI workflow for python projects
 
 # Run the CI test workflow of jobs which includes:
-# - `check`: Run static code checks (using `mypy`, `ruff`, etc.).
-# - `test`: Run tests (and code checks) using `tox`.
+# - `test`: Run tests (including code checks) using `tox`.
 # - `build`: Build the python package.
 # - `publish-test`: Publish the package to test.pypi.org.
 # - `publish`: Publish the package to pypi.org (runs `publish-test`).
 # - `release`: Create a GitHub release.
 
-on:
-  push:
-    branches: ["**"]  # Push commits to any branch
-    tags: ["v[0-9]*"]  # Publish on tags matching "v*", eg. "v1.0.0"
-
 # Configure the workflows here. Each environment variable name should be a
 # wildcard matching the
 # `on-<github.event_name>-<github.ref_type>-<github.ref_name>` format. For
@@ -30,65 +24,68 @@ env:
     python-version=["3.9", "3.10", "3.11", "3.12", "3.13"]
     os=["ubuntu-latest"]
   on-push-branch-*: |  # Push commits to other branches
-    jobs=["test", "build", "publish-test"]
+    jobs=["test", "build"]
     python-version=["3.9", "3.13"]
     os=["ubuntu-latest"]
+  on-workflow_dispatch-*: |  # Manual trigger of the workflow
+    jobs=["test", "build"]
+    python-version=["3.9", "3.13"]
+    os=["ubuntu-latest"]
+
+on:
+  push:
+    branches: ["**"]  # Push commits to any branch
+    tags: ["v[0-9]*"]  # Publish on tags matching "v*", eg. "v1.0.0"
+  workflow_dispatch:  # Allow manual triggering of the workflow
 
 jobs:
-  config:
-    # Select the workflow config based on the event trigger.
-    runs-on: ubuntu-latest
+  config:  # Select the workflow config based on the event trigger.
+    name: Configure workflow
     outputs:
       jobs: ${{ steps.config.outputs.jobs }}
-      python-version: ${{ steps.config.outputs.python-version }}
       os: ${{ steps.config.outputs.os }}
+      python-version: ${{ steps.config.outputs.python-version }}
+    runs-on: ubuntu-latest
     steps:
-      - name: Select the workflow configuration
-        id: config
-        run: |  # Find the matching environment variable based on the event trigger
-          tag="on-${{ github.event_name }}-${{ github.ref_type }}-${{ github.ref_name }}"
-          for key in $(echo '${{ toJson(env) }}' | jq -r 'keys_unsorted[]'); do
-            if [[ "$tag" == $key ]]; then
-              # Write value of the matching environment variable to $GITHUB_OUTPUT
-              echo '${{ toJson(env) }}' | jq -r ".[\"$key\"]" >> $GITHUB_OUTPUT
-              exit 0  # Stop after the first match
-            fi
-          done
-          echo "No matching environment variable found for '$tag'."
+      - id: config
+        uses: glenn20/python-ci/actions/config@dev
+        with:
+          config: ${{ toJson(env) }}
 
-  ci-workflow:
+  ci-workflow:  # Run the CI workflow based on the config.
     name: CI workflow
     needs: config
-    uses: ./.github/workflows/ci-workflow.yaml
+    uses: glenn20/python-ci/.github/workflows/ci-workflow-tox.yaml@dev
     with:
       jobs: ${{ needs.config.outputs.jobs }}
       os: ${{ needs.config.outputs.os }}
       python-version: ${{ needs.config.outputs.python-version }}
 
   # We can't use trusted publishing from a reusable workflow in another
-  # repository, so the publish workflows must be run from here, not in the
-  # ci-workflow.yaml.
+  # repository, so the publish workflows must be run from here.
   publish:
-    if: ${{ contains(needs.config.outputs.jobs, '"publish') }}
     name: Publish to pypi.org
-    runs-on: ubuntu-latest
     needs: [config, ci-workflow]
+    runs-on: ubuntu-latest
+    if: ${{ contains(needs.config.outputs.jobs, 'publish') }}
     environment:
       name: publish-pypi
       url: ${{ steps.publish.outputs.url }}
     permissions:
       id-token: write  # Required for trusted publishing
     steps:
       - id: publish
-        uses: glenn20/python-ci/publish@dev
+        uses: glenn20/python-ci/actions/publish@v2
         with:
-          test-only: ${{ contains(needs.config.outputs.jobs, '"publish"') && 'true' || 'false' }}
+          test-only: ${{ contains(fromJson(needs.config.outputs.jobs), 'publish') && 'false' || 'true' }}
 
+  # We run the github release job here instead of in ci-workflow, as it requires
+  # permissions to sign the release and to simplify the workflow dependency
+  # graph on the github UI.
   release:
-    if: ${{ contains(fromJson(needs.config.outputs.jobs), 'release') }}
-    name: Create GitHub release
     needs: [config, ci-workflow]
+    uses: glenn20/python-ci/.github/workflows/github-release.yaml@v2
     permissions:
-      id-token: write  # IMPORTANT: mandatory for github release
-      contents: write  # IMPORTANT: mandatory for github release
-    uses: glenn20/python-ci/.github/workflows/github-release.yaml@dev
+      id-token: write  # Required for signing the release
+      contents: write  # Required for github release
+    if: ${{ contains(fromJson(needs.config.outputs.jobs), 'release') }}