Merge branch 'main' into tooling_updates

Author: bmos

.github/workflows/python-checks.yml

@@ -36,7 +36,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
+      - uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49
         with:
           disable-sudo: true
           egress-policy: audit
@@ -48,7 +48,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
           cache: pip
 
-      - uses: install-pinned/uv@1fd41179ee60eee2496694a1226cece304efa071
+      - uses: install-pinned/uv@51bb057ca8857db7531f188d414ba32b7bb16d2b
 
       - if: matrix.resolution != 'limited-dependencies'
         run: |
@@ -82,7 +82,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
+      - uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49
         with:
           disable-sudo: true
           egress-policy: block
@@ -98,7 +98,7 @@ jobs:
           python-version: 3.13
           cache: pip
 
-      - uses: install-pinned/uv@1fd41179ee60eee2496694a1226cece304efa071
+      - uses: install-pinned/uv@51bb057ca8857db7531f188d414ba32b7bb16d2b
 
       - run: uv pip install --system -r requirements-dev.txt
 
@@ -118,7 +118,7 @@ jobs:
       security-events: write
 
     steps:
-      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
+      - uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49
         with:
           disable-sudo: true
           egress-policy: block
@@ -135,7 +135,7 @@ jobs:
           python-version: 3.13
           cache: pip
 
-      - uses: install-pinned/uv@1fd41179ee60eee2496694a1226cece304efa071
+      - uses: install-pinned/uv@51bb057ca8857db7531f188d414ba32b7bb16d2b
 
       - run: uv pip install --system -r requirements-dev.txt
 
@@ -166,7 +166,7 @@ jobs:
       security-events: write
 
     steps:
-      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
+      - uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49
         with:
           disable-sudo: true
           egress-policy: block
@@ -183,7 +183,7 @@ jobs:
           python-version: 3.13
           cache: pip
 
-      - uses: install-pinned/uv@1fd41179ee60eee2496694a1226cece304efa071
+      - uses: install-pinned/uv@51bb057ca8857db7531f188d414ba32b7bb16d2b
 
       - run: uv pip install --system -r requirements-dev.txt
 
@@ -210,7 +210,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
+      - uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49
         with:
           disable-sudo: true
           egress-policy: block
@@ -249,7 +249,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
+      - uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49
         with:
           disable-sudo: true
           egress-policy: block
@@ -266,7 +266,7 @@ jobs:
           python-version: 3.13
           cache: pip
 
-      - uses: install-pinned/uv@1fd41179ee60eee2496694a1226cece304efa071
+      - uses: install-pinned/uv@51bb057ca8857db7531f188d414ba32b7bb16d2b
 
       - run: uv pip install --system -r requirements-dev.txt
 
@@ -303,7 +303,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
+      - uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49
         with:
           disable-sudo: true
           egress-policy: audit

.github/workflows/release.yml

@@ -0,0 +1,84 @@
+name: Build & Publish Wheels + Source
+
+on:
+  release:
+    types: [published]
+
+permissions:
+    contents: read
+
+jobs:
+  build_wheels:
+    name: Build wheels on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Python 3.13
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+        with:
+            python-version: "3.13"
+            cache: "pip"
+
+      - name: Install uv
+        uses: install-pinned/uv@b9511b633710c8bbe8ba48376771dba624746799  # 0.4.12
+
+      - name: Install dependencies
+        run: |
+            uv pip install --system -r requirements-dev.txt
+            uv pip install --system -e .[all]
+
+      - name: Check setup.py
+        run: |
+          python setup.py check
+
+      - name: Build src dist
+        if: ${{ matrix.os == 'ubuntu-latest' }}
+        run: |
+          python -m build --sdist --outdir wheels parsons
+
+      - name: Build wheels
+        run: git pull && python -m cibuildwheel parsons/ --output-dir wheels
+
+       # Save wheels as artifacts
+      - name: Upload built wheels
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: wheels-${{ matrix.os }}
+          path: wheels
+
+  publish_wheels:
+    if: github.repository_owner == 'move-coop'
+    needs: build_wheels
+
+    runs-on: ubuntu-latest
+    environment: release
+
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Download wheels
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        with:
+          pattern: wheels-*
+          path: wheels
+          merge-multiple: true
+
+      # Publish
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
+        with:
+          verify-metadata: true
+          skip-existing: true
+          packages-dir: wheels
+          verbose: true