Adding Why deblotch section to README. #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Publish to PyPI when a version tag is pushed, e.g. `git tag v0.1.0 && git push origin v0.1.0`. | |
| # The tagged commit has to prove itself here: the full CI (tests on every supported Python, | |
| # lint, format, types, build, wheel smoke test) reruns below and gates the publish, so | |
| # tagging the wrong commit can never publish anything. | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| # Least privilege by default. The publish job opts into id-token below. | |
| permissions: | |
| contents: read | |
| jobs: | |
| version: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Catch the classic slip (tagging before committing the version bump) here, in seconds and | |
| # with a clear message, instead of at the upload with PyPI's "File already exists". | |
| - name: Tag must match the packaged version | |
| run: | | |
| tag="${GITHUB_REF_NAME#v}" | |
| pkg=$(grep -m1 '^version' pyproject.toml | cut -d'"' -f2) | |
| if [ "$tag" != "$pkg" ]; then | |
| echo "::error::Tag v$tag does not match pyproject.toml version $pkg. Commit the version bump, then re-tag that commit." | |
| exit 1 | |
| fi | |
| ci: | |
| name: CI on the tagged commit | |
| needs: version | |
| uses: ./.github/workflows/ci.yml | |
| publish: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - version | |
| - ci | |
| # Bind to a GitHub Environment named "pypi". Add a required reviewer on it so a tag push | |
| # cannot publish without manual approval, and configure the matching trusted publisher on PyPI. | |
| environment: pypi | |
| permissions: | |
| id-token: write # required for PyPI trusted publishing (OIDC), no stored token | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Build sdist and wheel | |
| run: uv build | |
| # In GitHub Actions with id-token write, uv publishes via trusted publishing (OIDC). | |
| # It fetches a short-lived, single-use token from PyPI, so nothing is stored anywhere. | |
| - name: Publish to PyPI | |
| run: uv publish --trusted-publishing always |