-
Notifications
You must be signed in to change notification settings - Fork 4
166 lines (141 loc) · 4.2 KB
/
release.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
---
name: "🐍📦 Production build and release"
# GitHub/PyPI trusted publisher documentation:
# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
# yamllint disable-line rule:truthy
on:
# workflow_dispatch:
push:
# Only invoked on release tag pushes
tags:
- v*.*.*
env:
python-version: "3.10"
### BUILD ###
jobs:
build:
name: "🐍 Build packages"
runs-on: ubuntu-latest
permissions:
# IMPORTANT: mandatory for Sigstore
id-token: write
steps:
### BUILDING ###
- name: "Checkout repository"
uses: actions/checkout@v4
- name: "Setup Python"
uses: actions/setup-python@v5
with:
python-version: ${{ env.python-version }}
- name: "Setup PDM for build commands"
uses: pdm-project/setup-pdm@v3
- name: "Update version from tags for production release"
run: |
echo "Github versioning: ${{ github.ref_name }}"
scripts/release-versioning.sh
- name: "Build with PDM backend"
run: |
pdm build
### SIGNING ###
- name: "Sign packages with Sigstore"
uses: sigstore/[email protected]
with:
inputs: >-
./dist/*.tar.gz
./dist/*.whl
- name: Store the distribution packages
uses: actions/upload-artifact@v4
with:
name: ${{ github.ref_name }}
path: dist/
### PUBLISH GITHUB ###
github:
name: "📦 Publish to GitHub"
# Only publish on tag pushes
if: startsWith(github.ref, 'refs/tags/')
needs:
- build
runs-on: ubuntu-latest
permissions:
# IMPORTANT: mandatory to publish artefacts
contents: write
steps:
- name: "⬇ Download build artefacts"
uses: actions/download-artifact@v4
with:
name: ${{ github.ref_name }}
path: dist/
- name: "📦 Publish release to GitHub"
uses: ModeSevenIndustrialSolutions/action-automatic-releases@latest
with:
# Valid inputs are:
# repo_token, automatic_release_tag, draft, prerelease, title, files
repo_token: ${{ secrets.GITHUB_TOKEN }}
prerelease: false
automatic_release_tag: ${{ github.ref_name }}
title: ${{ github.ref_name }}
files: |
dist/*.tar.gz
dist/*.whl
dist/*.sigstore
### PUBLISH PYPI TEST ###
testpypi:
name: "📦 Publish to PyPi Test"
# Only publish on tag pushes
if: startsWith(github.ref, 'refs/tags/')
needs:
- build
runs-on: ubuntu-latest
environment:
name: testpypi
permissions:
# IMPORTANT: mandatory for trusted publishing
id-token: write
steps:
- name: "⬇ Download build artefacts"
uses: actions/download-artifact@v4
with:
name: ${{ github.ref_name }}
path: dist/
- name: "Remove files unsupported by PyPi"
run: |
if [ -f dist/buildvars.txt ]; then
rm dist/buildvars.txt
fi
rm dist/*.sigstore
- name: Publish distribution to Test PyPI
uses: pypa/gh-action-pypi-publish@release/v1
with:
repository-url: https://test.pypi.org/legacy/
verbose: true
### PUBLISH PYPI ###
pypi:
name: "📦 Publish to PyPi"
# Only publish on tag pushes
if: startsWith(github.ref, 'refs/tags/')
needs:
- testpypi
runs-on: ubuntu-latest
environment:
name: pypi
permissions:
# IMPORTANT: mandatory for trusted publishing
id-token: write
steps:
- name: "⬇ Download build artefacts"
uses: actions/download-artifact@v4
with:
name: ${{ github.ref_name }}
path: dist/
- name: "Remove files unsupported by PyPi"
run: |
if [ -f dist/buildvars.txt ]; then
rm dist/buildvars.txt
fi
rm dist/*.sigstore
- name: "Setup PDM for build commands"
uses: pdm-project/setup-pdm@v3
- name: "Publish release to PyPI"
uses: pypa/gh-action-pypi-publish@release/v1
with:
verbose: true