From b93b9a75d47913f5b1811082ae3732c94df27b21 Mon Sep 17 00:00:00 2001 From: domna Date: Tue, 16 Jul 2024 15:50:55 +0200 Subject: [PATCH 1/4] Updates publishing ci/cd according to https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#configuring-trusted-publishing --- .github/workflows/python-publish.yml | 130 +++++++++++++++++++++------ 1 file changed, 103 insertions(+), 27 deletions(-) diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index 4caa4fad..ed8a3b7f 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -1,38 +1,114 @@ -# This workflow will upload a Python Package using Twine when a release is created -# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries +name: Publish Python 🐍 distribution 📦 to PyPI and TestPyPI -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Upload Python Package - -on: - release: - types: [published] +on: push jobs: - deploy: - + build: + name: Build distribution 📦 runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - with: - submodules: recursive - name: Set up Python uses: actions/setup-python@v5 with: - python-version: '3.x' - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install build - - name: Build package - run: python -m build - - name: Publish package - uses: pypa/gh-action-pypi-publish@27b31702a0e7fc50959f5ad993c78deac1bdfc29 + python-version: "3.x" + - name: Install pypa/build + run: >- + python3 -m + pip install + build + --user + - name: Build a binary wheel and a source tarball + run: python3 -m build + - name: Store the distribution packages + uses: actions/upload-artifact@v3 + with: + name: python-package-distributions + path: dist/ + + publish-to-pypi: + name: >- + Publish Python 🐍 distribution 📦 to PyPI + if: startsWith(github.ref, 'refs/tags/') + needs: + - build + runs-on: ubuntu-latest + environment: + name: pypi + url: https://pypi.org/p/pyElli/ + permissions: + id-token: write + + steps: + - name: Download all the dists + uses: actions/download-artifact@v3 + with: + name: python-package-distributions + path: dist/ + - name: Publish distribution 📦 to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 + + github-release: + name: >- + Sign the Python 🐍 distribution 📦 with Sigstore + and upload them to GitHub Release + needs: + - publish-to-pypi + runs-on: ubuntu-latest + + permissions: + contents: write + id-token: write + + steps: + - name: Download all the dists + uses: actions/download-artifact@v3 + with: + name: python-package-distributions + path: dist/ + - name: Sign the dists with Sigstore + uses: sigstore/gh-action-sigstore-python@v2.1.1 + with: + inputs: >- + ./dist/*.tar.gz + ./dist/*.whl + - name: Create GitHub Release + env: + GITHUB_TOKEN: ${{ github.token }} + run: >- + gh release create + '${{ github.ref_name }}' + --repo '${{ github.repository }}' + --notes "" + - name: Upload artifact signatures to GitHub Release + env: + GITHUB_TOKEN: ${{ github.token }} + run: >- + gh release upload + '${{ github.ref_name }}' dist/** + --repo '${{ github.repository }}' + + publish-to-testpypi: + name: Publish Python 🐍 distribution 📦 to TestPyPI + needs: + - build + runs-on: ubuntu-latest + + environment: + name: testpypi + url: https://test.pypi.org/p/pyElli + + permissions: + id-token: write + + steps: + - name: Download all the dists + uses: actions/download-artifact@v3 + with: + name: python-package-distributions + path: dist/ + - name: Publish distribution 📦 to TestPyPI + uses: pypa/gh-action-pypi-publish@release/v1 with: - user: __token__ - password: ${{ secrets.PYPI_API_TOKEN }} + repository-url: https://test.pypi.org/legacy/ \ No newline at end of file From 7bd5b96aaca416e4a113da409a803a3248ece8c9 Mon Sep 17 00:00:00 2001 From: domna Date: Tue, 16 Jul 2024 18:00:24 +0200 Subject: [PATCH 2/4] Remove test pypi deployments --- .github/workflows/python-publish.yml | 26 +------------------------- 1 file changed, 1 insertion(+), 25 deletions(-) diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index ed8a3b7f..1ba6bcbb 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -1,4 +1,4 @@ -name: Publish Python 🐍 distribution 📦 to PyPI and TestPyPI +name: Publish 📦 on: push @@ -88,27 +88,3 @@ jobs: gh release upload '${{ github.ref_name }}' dist/** --repo '${{ github.repository }}' - - publish-to-testpypi: - name: Publish Python 🐍 distribution 📦 to TestPyPI - needs: - - build - runs-on: ubuntu-latest - - environment: - name: testpypi - url: https://test.pypi.org/p/pyElli - - permissions: - id-token: write - - steps: - - name: Download all the dists - uses: actions/download-artifact@v3 - with: - name: python-package-distributions - path: dist/ - - name: Publish distribution 📦 to TestPyPI - uses: pypa/gh-action-pypi-publish@release/v1 - with: - repository-url: https://test.pypi.org/legacy/ \ No newline at end of file From 46d0af2923bc8e3e9d16da5058b65ad1b40a185d Mon Sep 17 00:00:00 2001 From: domna Date: Tue, 16 Jul 2024 18:03:00 +0200 Subject: [PATCH 3/4] Upload packages directly --- .github/workflows/python-publish.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index 1ba6bcbb..103559bf 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -25,7 +25,9 @@ jobs: uses: actions/upload-artifact@v3 with: name: python-package-distributions - path: dist/ + path: | + dist/*.whl + dist/*.tar.gz publish-to-pypi: name: >- From f83625d133ba792b9e4f92b9be953629c2f90f87 Mon Sep 17 00:00:00 2001 From: domna Date: Tue, 16 Jul 2024 18:05:11 +0200 Subject: [PATCH 4/4] Just upload dist folder --- .github/workflows/python-publish.yml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index 103559bf..3384c9bf 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -25,13 +25,11 @@ jobs: uses: actions/upload-artifact@v3 with: name: python-package-distributions - path: | - dist/*.whl - dist/*.tar.gz + path: dist/ publish-to-pypi: name: >- - Publish Python 🐍 distribution 📦 to PyPI + Publish to PyPi if: startsWith(github.ref, 'refs/tags/') needs: - build @@ -53,8 +51,7 @@ jobs: github-release: name: >- - Sign the Python 🐍 distribution 📦 with Sigstore - and upload them to GitHub Release + GitHub Release needs: - publish-to-pypi runs-on: ubuntu-latest