fix(ci): surface crates.io publish auth failures and require token be… #703
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to PyPI | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| - 'test-*' | |
| jobs: | |
| validate-branch: | |
| name: Verify tag is on main | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check tag is on main | |
| run: | | |
| if ! git merge-base --is-ancestor ${{ github.sha }} origin/main; then | |
| echo "Tag ${{ github.ref_name }} is not on main branch" | |
| exit 1 | |
| fi | |
| echo "Tag ${{ github.ref_name }} is on main branch" | |
| build-wheels: | |
| name: Build wheels on ${{ matrix.os }} (${{ matrix.target }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Linux x86_64 (manylinux_2_28 for broader compatibility) | |
| - os: ubuntu-latest | |
| target: x86_64-unknown-linux-gnu | |
| manylinux: 2_28 | |
| args: "" | |
| # Linux ARM64 (manylinux_2_28) | |
| - os: ubuntu-latest | |
| target: aarch64-unknown-linux-gnu | |
| manylinux: 2_28 | |
| args: "" | |
| # macOS universal2 (single wheel for both Intel and Apple Silicon) | |
| - os: macos-14 | |
| target: universal2-apple-darwin | |
| args: "--target universal2-apple-darwin" | |
| # Windows x86_64 | |
| - os: windows-latest | |
| target: x86_64-pc-windows-msvc | |
| args: "" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up QEMU | |
| if: runner.os == 'Linux' && matrix.target != 'x86_64-unknown-linux-gnu' | |
| uses: docker/setup-qemu-action@v4 | |
| with: | |
| platforms: all | |
| - name: Build wheels with maturin | |
| uses: PyO3/maturin-action@v1 | |
| with: | |
| target: ${{ matrix.target }} | |
| manylinux: ${{ matrix.manylinux }} | |
| # `--features pyo3/extension-module` OVERRIDES the dev `[tool.maturin] | |
| # features` list (which adds `degenbot-bot/hotpath` for local profiling) | |
| # so the shipped wheel excludes hotpath — its `#[hotpath::measure]` | |
| # macros expand to no-op `lib_off` stubs, zero runtime penalty. See | |
| # rust/crates/degenbot-bot/src/profiling.rs. | |
| args: --release --out dist --features pyo3/extension-module ${{ matrix.args }} | |
| sccache: 'true' | |
| # Pin the native (non-manylinux) legs to the same Rust as ci.yml's | |
| # dtolnay jobs. Unpinned, each runner image builds with its own | |
| # preinstalled rustc (the macos-14 image's older one left a | |
| # `#[expect(dead_code)]` in degenbot-db unfulfilled and broke the | |
| # wheel build under the workspace's `warnings = "deny"`). | |
| rust-toolchain: stable | |
| working-directory: . | |
| - name: Upload wheels | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: wheels-${{ matrix.target }} | |
| path: dist/*.whl | |
| build-sdist: | |
| name: Build source distribution | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Build sdist with maturin | |
| uses: PyO3/maturin-action@v1 | |
| with: | |
| command: sdist | |
| args: --out dist | |
| working-directory: . | |
| - name: Upload sdist | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: sdist | |
| path: dist/*.tar.gz | |
| publish-to-test-pypi: | |
| name: Publish to Test PyPI | |
| if: startsWith(github.ref, 'refs/tags/test-') | |
| needs: [validate-branch, build-wheels, build-sdist] | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: testpypi | |
| url: https://test.pypi.org/p/degenbot | |
| permissions: | |
| id-token: write | |
| steps: | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| path: dist | |
| pattern: '*' | |
| merge-multiple: true | |
| - name: List distribution files | |
| run: ls -la dist/ | |
| - name: Publish to Test PyPI | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| repository-url: https://test.pypi.org/legacy/ | |
| publish-to-pypi: | |
| name: Publish to PyPI | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: [validate-branch, build-wheels, build-sdist] | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: pypi | |
| url: https://pypi.org/p/degenbot | |
| permissions: | |
| id-token: write | |
| steps: | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| path: dist | |
| pattern: '*' | |
| merge-multiple: true | |
| - name: List distribution files | |
| run: ls -la dist/ | |
| - name: Publish to PyPI | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| github-release: | |
| name: Create GitHub Release | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: publish-to-pypi | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| path: dist | |
| pattern: '*' | |
| merge-multiple: true | |
| - name: Sign with Sigstore | |
| uses: sigstore/gh-action-sigstore-python@v3.5.0 | |
| with: | |
| inputs: >- | |
| ./dist/*.tar.gz | |
| ./dist/*.whl | |
| - name: Create GitHub Release | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: >- | |
| gh release create | |
| '${{ github.ref_name }}' | |
| --repo '${{ github.repository }}' | |
| --notes "" | |
| - name: Upload artifacts to GitHub Release | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: >- | |
| gh release upload | |
| '${{ github.ref_name }}' dist/** | |
| --repo '${{ github.repository }}' |