Skip to content

Commit 7724d3d

Browse files
jdrhynejdrhyne
committed
feat: add GitHub trusted publishing for PyPI releases
- Update release workflow to use trusted publishing instead of API tokens - Add workflow to publish existing tags (for v1.0.2) - Add comprehensive release process documentation - Include v1.0.2 release notes This eliminates the need for PyPI API tokens and uses GitHub's OIDC authentication for more secure and reliable releases.
1 parent 39aba1c commit 7724d3d

File tree

4 files changed

+172
-7
lines changed

4 files changed

+172
-7
lines changed

‎.github/workflows/publish-existing-tag.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Publish Existing Tag to PyPI
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
tag:
7+
description: 'Tag to publish (e.g., v1.0.2)'
8+
required: true
9+
default: 'v1.0.2'
10+
11+
jobs:
12+
build-and-publish:
13+
name: Build and Publish to PyPI
14+
runs-on: ubuntu-latest
15+
16+
# IMPORTANT: This permission is required for trusted publishing
17+
permissions:
18+
id-token: write
19+
20+
steps:
21+
- name: Checkout specific tag
22+
uses: actions/checkout@v4
23+
with:
24+
ref: ${{ github.event.inputs.tag }}
25+
26+
- name: Set up Python
27+
uses: actions/setup-python@v5
28+
with:
29+
python-version: '3.10'
30+
31+
- name: Install build dependencies
32+
run: |
33+
python -m pip install --upgrade pip
34+
python -m pip install build
35+
36+
- name: Build distribution
37+
run: python -m build
38+
39+
- name: Publish to PyPI
40+
uses: pypa/gh-action-pypi-publish@release/v1
41+
# No need for username/password with trusted publishing!

‎.github/workflows/release.yml‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,18 @@ name: Release
22

33
on:
44
release:
5-
types: [created]
5+
types: [published] # Changed from 'created' to 'published' for better control
6+
# Allow manual trigger
7+
workflow_dispatch:
68

79
jobs:
810
deploy:
911
runs-on: ubuntu-latest
12+
13+
# IMPORTANT: Required for trusted publishing
14+
permissions:
15+
id-token: write
16+
contents: read
1017

1118
steps:
1219
- uses: actions/checkout@v4
@@ -16,16 +23,14 @@ jobs:
1623
with:
1724
python-version: '3.12'
1825

19-
- name: Install dependencies
26+
- name: Install build dependencies
2027
run: |
2128
python -m pip install --upgrade pip
22-
pip install -e ".[dev]"
29+
python -m pip install build
2330
2431
- name: Build package
2532
run: python -m build
2633

2734
- name: Publish to PyPI
28-
env:
29-
TWINE_USERNAME: __token__
30-
TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
31-
run: twine upload dist/*
35+
uses: pypa/gh-action-pypi-publish@release/v1
36+
# No API token needed with trusted publishing!

‎RELEASE_NOTES_v1.0.2.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# v1.0.2 - Major Feature Release
2+
3+
## What's Changed
4+
5+
This release adds significant new functionality with 13 new Direct API methods and numerous stability improvements.
6+
7+
### ✨ New Features
8+
9+
#### Direct API Methods
10+
- `create_redactions_preset()` - Create redactions using predefined patterns (SSN, email, phone, etc.)
11+
- `create_redactions_regex()` - Create redactions using custom regex patterns
12+
- `create_redactions_text()` - Create redactions for specific text strings
13+
- `optimize_pdf()` - Optimize PDF file size and performance
14+
- `password_protect_pdf()` - Add password protection to PDFs
15+
- `set_pdf_metadata()` - Update PDF metadata (title, author)
16+
- `split_pdf()` - Split PDFs into multiple files based on page ranges
17+
- `duplicate_pdf_pages()` - Duplicate specific pages within a PDF
18+
- `delete_pdf_pages()` - Remove specific pages from a PDF
19+
- `add_page()` - Insert blank pages at specific positions
20+
- `apply_instant_json()` - Apply PSPDFKit Instant JSON annotations
21+
- `apply_xfdf()` - Apply XFDF annotations to PDFs
22+
- `set_page_label()` - Set custom page labels (Roman numerals, letters, etc.)
23+
24+
#### Enhancements
25+
- 🖼️ Image file support for `watermark_pdf()` method - now accepts PNG/JPEG images as watermarks
26+
- 🧪 Improved CI/CD integration test strategy with better error reporting
27+
- 📈 Enhanced test coverage for all new Direct API methods
28+
29+
### 🐛 Bug Fixes
30+
- Critical API compatibility issues in Direct API integration
31+
- Python 3.9 and 3.10 syntax compatibility across the codebase
32+
- Comprehensive CI failure resolution
33+
- Integration test fixes to match actual API behavior patterns
34+
- Ruff linting and formatting issues throughout the project
35+
- MyPy type checking errors and improved type annotations
36+
- Removed unsupported parameters from API calls
37+
- Fixed page range handling in split_pdf with proper defaults
38+
- Resolved runtime errors with isinstance union syntax
39+
- Updated test fixtures to use valid PNG images
40+
41+
### 📋 Requirements
42+
- Python 3.10+ (maintained as per project design)
43+
- requests>=2.25.0,<3.0.0
44+
45+
### 📦 Installation
46+
```bash
47+
pip install nutrient-dws==1.0.2
48+
```
49+
50+
### 📚 Documentation
51+
See the [README](https://github.com/PSPDFKit/nutrient-dws-client-python#readme) for usage examples of the new features.
52+
53+
**Full Changelog**: https://github.com/PSPDFKit/nutrient-dws-client-python/compare/v1.0.1...v1.0.2

‎RELEASE_PROCESS.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Release Process
2+
3+
This document describes how to release a new version of nutrient-dws to PyPI using GitHub's trusted publishing.
4+
5+
## Prerequisites
6+
7+
1. PyPI account with maintainer access to nutrient-dws
8+
2. GitHub repository configured as a trusted publisher on PyPI
9+
3. Write access to the GitHub repository
10+
11+
## Automatic Release Process (Recommended)
12+
13+
### For New Releases
14+
15+
1. Update version in `pyproject.toml`
16+
2. Update `CHANGELOG.md` with release notes
17+
3. Commit changes: `git commit -m "chore: prepare release v1.0.x"`
18+
4. Create and push tag: `git tag v1.0.x && git push origin v1.0.x`
19+
5. Create GitHub release:
20+
- Go to https://github.com/PSPDFKit/nutrient-dws-client-python/releases/new
21+
- Select the tag you just created
22+
- Add release notes
23+
- Click "Publish release"
24+
6. The `Release` workflow will automatically trigger and upload to PyPI
25+
26+
### For Existing Tags (like v1.0.2)
27+
28+
1. Go to Actions tab in GitHub
29+
2. Select "Publish Existing Tag to PyPI" workflow
30+
3. Click "Run workflow"
31+
4. Enter the tag name (e.g., `v1.0.2`)
32+
5. Click "Run workflow"
33+
6. Monitor the workflow progress
34+
35+
## Manual Trigger
36+
37+
You can also manually trigger the release workflow:
38+
1. Go to Actions tab
39+
2. Select "Release" workflow
40+
3. Click "Run workflow"
41+
4. Select branch/tag and run
42+
43+
## Verification
44+
45+
After publishing:
46+
1. Check PyPI: https://pypi.org/project/nutrient-dws/
47+
2. Test installation: `pip install nutrient-dws==1.0.x`
48+
3. Verify the GitHub release page shows the release
49+
50+
## Troubleshooting
51+
52+
### Trusted Publisher Issues
53+
- Ensure the GitHub repository is configured as a trusted publisher on PyPI
54+
- Check that the workflow has `id-token: write` permission
55+
- Verify the PyPI project name matches exactly
56+
57+
### Build Issues
58+
- Ensure `pyproject.toml` is valid
59+
- Check that all required files are present
60+
- Verify Python version compatibility
61+
62+
## Security Notes
63+
64+
- No API tokens or passwords are needed with trusted publishing
65+
- GitHub Actions uses OIDC to authenticate with PyPI
66+
- This is more secure than storing PyPI tokens as secrets

0 commit comments

Comments
 (0)