|
8 | 8 | - rel/* |
9 | 9 | tags: |
10 | 10 | - '*' |
| 11 | + pull_request: |
| 12 | + branches: |
| 13 | + - main |
| 14 | + - maint/* |
| 15 | + workflow_dispatch: |
11 | 16 |
|
12 | 17 | defaults: |
13 | 18 | run: |
14 | 19 | shell: bash |
15 | 20 |
|
| 21 | +concurrency: |
| 22 | + group: ${{ github.workflow }}-${{ github.ref }} |
| 23 | + cancel-in-progress: true |
| 24 | + |
| 25 | +permissions: |
| 26 | + contents: read |
| 27 | + |
16 | 28 | jobs: |
17 | | - package: |
18 | | - # Build packages and upload |
19 | | - runs-on: ${{ matrix.os }} |
20 | | - strategy: |
21 | | - matrix: |
22 | | - include: |
23 | | - - os: ubuntu-latest |
24 | | - python-version: "3" |
| 29 | + build: |
| 30 | + name: Build & verify package |
| 31 | + runs-on: ubuntu-latest |
| 32 | + permissions: |
| 33 | + attestations: write |
| 34 | + id-token: write |
25 | 35 | steps: |
26 | | - - uses: actions/checkout@v3 |
| 36 | + - uses: actions/checkout@v4 |
27 | 37 | with: |
28 | | - submodules: recursive |
29 | 38 | fetch-depth: 0 |
30 | | - - name: Set up Python ${{ matrix.python-version }} |
31 | | - uses: actions/setup-python@v4 |
| 39 | + - uses: hynek/build-and-inspect-python-package@v2 |
32 | 40 | with: |
33 | | - python-version: ${{ matrix.python-version }} |
34 | | - - name: Display Python version |
35 | | - run: python -c "import sys; print(sys.version)" |
36 | | - - name: Build sdist and wheel |
37 | | - run: pipx run build bsmschema |
38 | | - - name: Upload to PyPI (on tags) |
39 | | - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') |
40 | | - uses: pypa/gh-action-pypi-publish@release/v1 |
| 41 | + path: bsmschema |
| 42 | + attest-build-provenance-github: ${{ github.event_name != 'pull_request' }} |
| 43 | + |
| 44 | + publish: |
| 45 | + name: Publish package to PyPI |
| 46 | + if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') |
| 47 | + runs-on: ubuntu-latest |
| 48 | + needs: [build] |
| 49 | + permissions: |
| 50 | + attestations: write |
| 51 | + id-token: write |
| 52 | + |
| 53 | + steps: |
| 54 | + - name: Download packages built by build-and-inspect-python-package |
| 55 | + uses: actions/download-artifact@v4 |
41 | 56 | with: |
42 | | - user: __token__ |
43 | | - password: ${{ secrets.PYPI_API_TOKEN }} |
44 | | - packages-dir: bsmschema/dist |
| 57 | + name: Packages |
| 58 | + path: dist |
| 59 | + |
| 60 | + - name: Upload package to PyPI |
| 61 | + uses: pypa/gh-action-pypi-publish@release/v1 |
0 commit comments