wlc/.github/workflows/setup.yml at b8c97a829088bb7d8050281f3b560e6a7fc7ec9e · WeblateOrg/wlc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
# Copyright © Michal Čihař <michal@weblate.org>
#
# SPDX-License-Identifier: GPL-3.0-or-later

name: Distribution

on:
  push:
    branches-ignore:
    - renovate/**
    - dependabot/**
    tags:
    - '*'
  pull_request:

permissions:
  contents: read

jobs:
  setup:
    name: Build packages
    runs-on: ubuntu-24.04
    permissions:
      attestations: write
      contents: read
      id-token: write
    steps:
    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        persist-credentials: false
    - name: Setup Python
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: '3.14'
    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
      with:
        enable-cache: false
        version: 0.11.29
    - name: Install dependencies
      run: uv pip install --system -e .[dev]
    - name: build sdist
      run: uv build
    - name: twine
      run: uvx twine check dist/*
    - name: pydistcheck
      run: uvx pydistcheck --inspect dist/*
    - name: pyroma
      run: uvx pyroma dist/*.tar.gz
    - name: check-wheel-contents
      run: uvx check-wheel-contents dist/*.whl
    - name: check-manifest
      run: uvx check-manifest -v
    - name: Package version
      id: package
      run: python -c "from wlc.const import __version__; print(f'version={__version__}')" >> "$GITHUB_OUTPUT"
    - name: Install Syft
      id: syft
      uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
      with:
        syft-version: v1.38.0
    - name: Generate package SBOMs
      env:
        SYFT: ${{ steps.syft.outputs.cmd }}
        VERSION: ${{ steps.package.outputs.version }}
      run: |
        mkdir -p dist/sboms
        "$SYFT" "dist/wlc-$VERSION.tar.gz" -o "cyclonedx-json=dist/sboms/wlc-$VERSION.tar.gz.cdx.json"
        "$SYFT" "dist/wlc-$VERSION-py3-none-any.whl" -o "cyclonedx-json=dist/sboms/wlc-$VERSION-py3-none-any.whl.cdx.json"
    - name: Attest package provenance
      if: startsWith(github.ref, 'refs/tags/') && github.repository == 'WeblateOrg/wlc'
      uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
      with:
        subject-path: |
          dist/wlc-${{ steps.package.outputs.version }}.tar.gz
          dist/wlc-${{ steps.package.outputs.version }}-py3-none-any.whl
    - name: Attest source package SBOM
      if: startsWith(github.ref, 'refs/tags/') && github.repository == 'WeblateOrg/wlc'
      uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
      with:
        subject-path: dist/wlc-${{ steps.package.outputs.version }}.tar.gz
        sbom-path: dist/sboms/wlc-${{ steps.package.outputs.version }}.tar.gz.cdx.json
    - name: Attest wheel SBOM
      if: startsWith(github.ref, 'refs/tags/') && github.repository == 'WeblateOrg/wlc'
      uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
      with:
        subject-path: dist/wlc-${{ steps.package.outputs.version }}-py3-none-any.whl
        sbom-path: dist/sboms/wlc-${{ steps.package.outputs.version }}-py3-none-any.whl.cdx.json

    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        path: |
          dist/*.tar.gz
          dist/*.whl
          dist/sboms/*.json
        name: dist

  release_pypi:
    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags') && github.repository == 'WeblateOrg/wlc'
    runs-on: ubuntu-24.04
    name: Publish release to PyPI
    permissions:
      contents: read
      # this permission is mandatory for trusted publishing
      id-token: write
    needs:
    - setup
    steps:
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: dist
        path: dist
    - name: Prepare packages
      run: |
        mkdir packages
        cp dist/*.tar.gz dist/*.whl packages/
    - name: Publish package
      uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
      with:
        packages-dir: packages

  release_github:
    runs-on: ubuntu-24.04
    name: Create release on GitHub
    permissions:
      contents: write
    needs:
    - setup
    if: startsWith(github.ref, 'refs/tags/')  && github.repository == 'WeblateOrg/wlc'
    steps:
    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        persist-credentials: false
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: dist
        path: dist
    - env:
        VERSION: ${{ github.ref_name }}
        GH_TOKEN: ${{ github.token }}
      run: |
        gh release create "$VERSION" --verify-tag --generate-notes dist/*.tar.gz dist/*.whl dist/sboms/*.json