Update release action #2172
Update release action #2172
Conversation
Replaces running on tag push, since this new way is more focused and dependent on actually making the release.
This restricts access to the PyPI token to ony the publish stage, rather than all code installed and executed during the setup and build parts. We can also restrict this to the PyPI environment.
This is better security practice than using master/main.
| - '*' | ||
| release: | ||
| types: | ||
| - published |
There was a problem hiding this comment.
Do we need to add a release guide to explain what we need to do to trigger this? I assume it is "go to GitHub and publish a release" because tagging via command line and pushing a tag is not good enough here?
There was a problem hiding this comment.
I mean, we can stick with "tag and push" if we want, I just looked and saw we were already using the GitHub releases feature.
There was a problem hiding this comment.
I'm good with this, I've been making releases through the web interface.
|
@dopplershift, this looks good to me. Feel free to merge this when you have some time to do the other tasks you've listed as well. I don't want to merge this and be in limbo when we haven't added the other pieces necessary yet to make a release and forget to update. |
|
All done. This workflow worked flawlessly on the most recent MetPy release. |
A few changes to update the GitHub release workflow
The last one is a new feature just released to general availability by PyPI. Instead of using a fixed API token (which is tied to one user's account--currently mine), you configure the project on PyPI to accept publication from a particular GitHub workflow and (optionally) environment. Transparently (using the PyPA GitHub Action we're already using) GitHub and PyPI exchange the needed tokens to allow publication to PyPI. The use of an environment additionally allows some gatekeeping like wait timers, restrict certain branches for "deployment", and manual approval for "deployment", if we were so inclined.
Assuming we want to go this way, the additional items that need to take place outside the PR merger: