Skip to content

Commit 2b62183

Browse files
kesarakesara
authored
ci: Use PyPI trusted publishing (#54)
1 parent 47de0bd commit 2b62183

File tree

1 file changed

+141
-77
lines changed

1 file changed

+141
-77
lines changed

‎.github/workflows/pypi-publish.yml‎

Lines changed: 141 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,50 @@
11
name: Publish Python Package
22

33
on:
4-
push:
5-
branches:
6-
- main
7-
tags:
8-
- 'v*'
9-
104
workflow_dispatch:
115
inputs:
12-
publish:
6+
publish_release:
137
description: 'Create Production Release'
148
required: true
159
type: boolean
1610

1711
jobs:
18-
publish:
12+
build:
13+
name: Build distribution 📦
1914
runs-on: ubuntu-latest
15+
outputs:
16+
pkg_version: ${{ steps.semver.outputs.next }}
2017

2118
steps:
22-
- uses: actions/checkout@v2
19+
- uses: actions/checkout@v4
2320
with:
21+
persist-credentials: false
2422
fetch-depth: 0
25-
23+
24+
- name: Set up Python
25+
uses: actions/setup-python@v5
26+
with:
27+
python-version: "3.x"
28+
2629
- name: Get Next Version
27-
if: ${{ github.event.inputs.publish }}
30+
if: ${{ inputs.publish_release }}
2831
id: semver
2932
uses: ietf-tools/semver-action@v1
3033
with:
34+
patchList: fix, bugfix, perf, refactor, test, tests, chore, revert
3135
token: ${{ github.token }}
3236
branch: main
33-
37+
3438
- name: Set Next Version Env Var
35-
if: ${{ github.event.inputs.publish }}
39+
if: ${{ inputs.publish_release }}
3640
env:
3741
NEXT_VERSION: ${{ steps.semver.outputs.next }}
3842
run: |
3943
echo "NEXT_VERSION=$next" >> $GITHUB_ENV
40-
44+
4145
- name: Create Draft Release
4246
uses: ncipollo/release-action@v1
43-
if: ${{ github.event.inputs.publish }}
47+
if: ${{ inputs.publish_release }}
4448
with:
4549
prerelease: true
4650
draft: false
@@ -49,86 +53,126 @@ jobs:
4953
name: ${{ env.NEXT_VERSION }}
5054
body: '*pending*'
5155
token: ${{ secrets.GITHUB_TOKEN }}
52-
56+
5357
- name: Set Build Variables
5458
run: |
5559
if [[ $NEXT_VERSION ]]; then
5660
echo "Using AUTO SEMVER mode: $NEXT_VERSION"
57-
echo "SHOULD_DEPLOY=true" >> $GITHUB_ENV
5861
echo "PKG_VERSION=$NEXT_VERSION" >> $GITHUB_ENV
5962
echo "PKG_VERSION_STRICT=${NEXT_VERSION#?}" >> $GITHUB_ENV
6063
elif [[ "$GITHUB_REF" =~ ^refs/tags/v* ]]; then
6164
echo "Using TAG mode: $GITHUB_REF_NAME"
62-
echo "SHOULD_DEPLOY=true" >> $GITHUB_ENV
6365
echo "PKG_VERSION=$GITHUB_REF_NAME" >> $GITHUB_ENV
6466
echo "PKG_VERSION_STRICT=${GITHUB_REF_NAME#?}" >> $GITHUB_ENV
6567
else
66-
echo "Using TEST mode: v2.0.0-dev.$GITHUB_RUN_NUMBER"
67-
echo "SHOULD_DEPLOY=false" >> $GITHUB_ENV
68-
echo "PKG_VERSION=v2.0.0-dev.$GITHUB_RUN_NUMBER" >> $GITHUB_ENV
69-
echo "PKG_VERSION_STRICT=2.0.0-dev.$GITHUB_RUN_NUMBER" >> $GITHUB_ENV
68+
echo "Using TEST mode: v3.0.0-dev.$GITHUB_RUN_NUMBER"
69+
echo "PKG_VERSION=v3.0.0-dev.$GITHUB_RUN_NUMBER" >> $GITHUB_ENV
70+
echo "PKG_VERSION_STRICT=3.0.0-dev.$GITHUB_RUN_NUMBER" >> $GITHUB_ENV
7071
fi
71-
72-
- name: Setup Python
73-
uses: actions/setup-python@v2
74-
with:
75-
python-version: '3.x'
76-
77-
- name: Install Python dependencies
78-
env:
79-
DEBIAN_FRONTEND: noninteractive
80-
run: |
81-
python -m venv venv
82-
source venv/bin/activate
83-
python -m pip install --upgrade pip setuptools wheel twine
84-
pip install build
85-
sudo apt update
86-
sudo apt install -y twine
87-
88-
- name: Build Python package
72+
73+
- name: Install pypa/build
74+
run: >-
75+
python3 -m
76+
pip install
77+
build
78+
setuptools
79+
--user
80+
81+
- name: Build a binary wheel and a source tarball
8982
run: |
9083
echo "Using version $PKG_VERSION_STRICT"
9184
sed -i -r -e "s/^__version__ = '.*'$/__version__ = '$PKG_VERSION_STRICT'/" rfc2html.py
9285
python ./setup.py setopt --command=metadata --option=version --set-value=$PKG_VERSION_STRICT
9386
python ./setup.py sdist --dist-dir dist
94-
95-
- name: Import Test GPG Key
96-
uses: crazy-max/ghaction-import-gpg@cb4264d3319acaa2bea23d51ef67f80b4f775013
97-
if: startsWith(github.ref, 'refs/tags/v') != true
98-
with:
99-
gpg_private_key: ${{ secrets.TEST_GPG_PRIVATE_KEY }}
100-
passphrase: ${{ secrets.TEST_GPG_PASSPHRASE }}
101-
102-
- name: Publish to Test PyPI
103-
if: env.SHOULD_DEPLOY != 'true'
104-
env:
105-
TWINE_USERNAME: __token__
106-
TWINE_PASSWORD: ${{ secrets.TEST_PYPI_TOKEN }}
107-
TWINE_REPOSITORY_URL: https://test.pypi.org/legacy/
108-
run: |
109-
echo "Using repository $TWINE_REPOSITORY_URL"
110-
twine check dist/*
111-
twine upload --verbose --sign dist/*
112-
87+
88+
- name: Store the distribution packages
89+
uses: actions/upload-artifact@v4
90+
with:
91+
name: python-package-distributions
92+
path: dist/
93+
94+
- name: Store updated version
95+
uses: actions/upload-artifact@v4
96+
with:
97+
name: rfc2html-version
98+
path: rfc2html.py
99+
100+
publish-to-pypi:
101+
name: >-
102+
Publish Python 🐍 distribution 📦 to PyPI
103+
needs:
104+
- build
105+
runs-on: ubuntu-latest
106+
environment:
107+
name: release
108+
url: https://pypi.org/p/rfc2html
109+
permissions:
110+
id-token: write
111+
if: ${{ inputs.publish_release }}
112+
113+
steps:
114+
- name: Download all the dists
115+
uses: actions/download-artifact@v4
116+
with:
117+
name: python-package-distributions
118+
path: dist/
119+
120+
- name: Publish distribution 📦 to PyPI
121+
uses: pypa/gh-action-pypi-publish@release/v1
122+
123+
github-release:
124+
name: >-
125+
Sign the Python 🐍 distribution 📦 with Sigstore
126+
and upload them to GitHub Release
127+
needs:
128+
- build
129+
- publish-to-pypi
130+
runs-on: ubuntu-latest
131+
132+
permissions:
133+
contents: write
134+
id-token: write
135+
packages: write
136+
pull-requests: write
137+
138+
steps:
139+
- uses: actions/checkout@v4
140+
with:
141+
fetch-depth: 0
142+
143+
- name: Download all the dists
144+
uses: actions/download-artifact@v4
145+
with:
146+
name: python-package-distributions
147+
path: dist/
148+
149+
- name: Download updated version file
150+
uses: actions/download-artifact@v4
151+
with:
152+
name: rfc2html-version
153+
path: ./
154+
merge-multiple: true
155+
156+
- name: Set Variables
157+
run: echo "PKG_VERSION=${{needs.build.outputs.pkg_version}}" >> $GITHUB_ENV
158+
113159
- name: Update CHANGELOG
114160
id: changelog
115161
uses: Requarks/changelog-action@v1
116-
if: env.SHOULD_DEPLOY == 'true'
117162
with:
118163
token: ${{ github.token }}
119164
tag: ${{ env.PKG_VERSION }}
165+
excludeTypes: ''
120166

121-
- name: Commit CHANGELOG.md
122-
uses: stefanzweifel/git-auto-commit-action@v4
123-
if: env.SHOULD_DEPLOY == 'true'
167+
- name: Sign the dists with Sigstore
168+
uses: sigstore/[email protected]
124169
with:
125-
branch: main
126-
commit_message: 'docs: update CHANGELOG.md + py files for ${{ env.PKG_VERSION }} [skip ci]'
127-
file_pattern: CHANGELOG.md setup.cfg rfc2html.py
128-
170+
inputs: >-
171+
./dist/*.tar.gz
172+
./dist/*.whl
173+
129174
- name: Create Release
130175
uses: ncipollo/release-action@v1
131-
if: env.SHOULD_DEPLOY == 'true'
132176
with:
133177
allowUpdates: true
134178
draft: false
@@ -137,12 +181,32 @@ jobs:
137181
body: ${{ steps.changelog.outputs.changes }}
138182
artifacts: "dist/**"
139183
token: ${{ secrets.GITHUB_TOKEN }}
140-
141-
- name: Upload Build Artifacts
142-
uses: actions/[email protected]
143-
with:
144-
name: artifacts
145-
path: |
146-
CHANGELOG.md
147-
rfc2html.py
148-
setup.cfg
184+
makeLatest: true
185+
186+
- name: Create Pull Request
187+
uses: peter-evans/create-pull-request@v7
188+
with:
189+
commit_message: 'docs: update CHANGELOG.md + py file versions for ${{ env.PKG_VERSION }} [skip ci]'
190+
191+
publish-to-testpypi:
192+
name: Publish Python 🐍 distribution 📦 to TestPyPI
193+
needs:
194+
- build
195+
runs-on: ubuntu-latest
196+
environment:
197+
name: release
198+
url: https://test.pypi.org/p/rfc2html
199+
permissions:
200+
id-token: write
201+
202+
steps:
203+
- name: Download all the dists
204+
uses: actions/download-artifact@v4
205+
with:
206+
name: python-package-distributions
207+
path: dist/
208+
209+
- name: Publish distribution 📦 to TestPyPI
210+
uses: pypa/gh-action-pypi-publish@release/v1
211+
with:
212+
repository-url: https://test.pypi.org/legacy/

0 commit comments

Comments
 (0)