pkgdev/.github/workflows/release.yml at main · pkgcore/pkgdev · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: release

on:
  push:
    branches: [release-test-pypi, release-test-github, release-test-full]
    tags: [v*]
  workflow_dispatch:


jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      release-artifact-id: ${{ steps.upload-release.outputs.artifact-id }}
      wheel-artifact-id: ${{ steps.upload-wheel.outputs.artifact-id }}
      artifact-runner: ${{ github.job }}

    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Reject any VCS dependencies
      continue-on-error: ${{ github.ref_type == 'branch' && github.ref_name != 'release-test-full' }}
      uses: pkgcore/gh-actions/reject-python-vcs-deps@main

    - name: Set up Python 3.13
      uses: actions/setup-python@v5
      with:
        python-version: "3.13"
        cache: 'pip'
        cache-dependency-path: pyproject.toml

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build ".[doc]"

    - name: Build the release
      run: |
        make release

    - name: Output dist file info
      run: |
        sha512sum dist/*
        echo ::group::Release contents
        tar -ztf dist/*.tar.gz | sort
        echo ::endgroup::
        echo ::group::All generated content in dist
        find .
        echo ::endgroup::

    - name: Upload wheel
      id: upload-wheel
      uses: actions/upload-artifact@v5
      with:
        name: wheel-release
        path: dist/*.whl
        if-no-files-found: error

    - name: Upload release source
      id: upload-release
      uses: actions/upload-artifact@v5
      with:
        name: release-source
        path: dist/*.tar.gz
        if-no-files-found: error

  test:
    needs: [build]
    uses: ./.github/workflows/test.yml
    with:
      release-artifact-id: ${{ needs.build.outputs.release-artifact-id }}
      disable-format-check: true

  publish:
    if: github.ref_type == 'tag'
    needs: [build, test]
    environment: release
    permissions:
      id-token: write # Used to authenticate to PyPI via OIDC
      contents: write # release uploads
    runs-on: ubuntu-latest

    steps:
    - &common_download_artifacts
      name: Download artifacts
      uses: actions/download-artifact@v5
      with:
        merge-multiple: true # store both in the root, not in named directories
        artifact-ids: ${{ needs.build.outputs.release-artifact-id }},${{ needs.build.outputs.wheel-artifact-id }}

    - name: Publish github source
      uses: softprops/action-gh-release@v2
      with:
        files: '*.tar.*'
        fail_on_unmatched_files: true

    - name: Publish to PyPi server
      uses: pypa/gh-action-pypi-publish@release/v1.13
      with:
        packages-dir: .

  test-publish:
    # use the full form to ensure insane tags and errors in 'on' filter still don't kick.
    if: github.ref_type == 'branch'
    needs: [build, test]
    environment: test-release
    permissions:
      id-token: write # Used to authenticate to PyPI via OIDC
      contents: write # release uploads-
    runs-on: ubuntu-latest

    steps:
    - *common_download_artifacts
    - name: Publish github source
      uses: softprops/action-gh-release@v2
      if: github.ref_name == 'release-test-github' || github.ref_name == 'release-test-full'
      with:
        files: '*.tar.*'
        fail_on_unmatched_files: true
        draft: true

    - name: Publish to Test PyPi server
      if: github.ref_name == 'release-test-pypi' || github.ref_name == 'release-test-full'
      uses: pypa/gh-action-pypi-publish@release/v1.13
      with:
        packages-dir: .
        repository-url: https://test.pypi.org/legacy/
        # attestations are bound in a way re-releasing isn't possible.  Disable for tests.
        attestations: false