-
Notifications
You must be signed in to change notification settings - Fork 23
152 lines (132 loc) · 5.23 KB
/
publish-package.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
name: publish distributions
on:
push:
branches:
- main
tags:
- v*
pull_request:
branches:
- main
- release/v*
release:
types: [published]
workflow_dispatch:
inputs:
publish:
type: choice
description: 'Publish to TestPyPI?'
options:
- false
- true
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
build:
name: Build Python distribution
runs-on: ubuntu-latest
permissions:
id-token: write
attestations: write
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Install dependencies
run: |
python -m pip install uv
- name: Build a sdist and a wheel
run: |
pipx run build --installer uv .
- name: Verify history available for dev versions
run: |
wheel_name=$(find dist/ -iname "*.whl" -printf "%f\n")
if [[ "${wheel_name}" == *"pylhe-0.1.dev"* ]]; then
echo "python-build incorrectly named built distribution: ${wheel_name}"
echo "python-build is lacking the history and tags required to determine version number"
echo "intentionally erroring with 'return 1' now"
return 1
fi
echo "python-build named built distribution: ${wheel_name}"
- name: Verify the distribution
run: pipx run twine check --strict dist/*
- name: List contents of sdist
run: python -m tarfile --list dist/pylhe-*.tar.gz
- name: List contents of wheel
run: python -m zipfile --list dist/pylhe-*.whl
- name: Generate artifact attestation for sdist and wheel
# If publishing to TestPyPI or PyPI
if: >-
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe')
|| (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe')
|| (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe')
uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
with:
subject-path: "dist/pylhe-*"
- name: Upload distribution artifact
uses: actions/upload-artifact@v4
with:
name: dist-artifact
path: dist
publish:
name: Publish Python distribution to (Test)PyPI
if: github.event_name != 'pull_request'
needs: build
runs-on: ubuntu-latest
# Mandatory for publishing with a trusted publisher
# c.f. https://docs.pypi.org/trusted-publishers/using-a-publisher/
permissions:
id-token: write
# Restrict to the environment set for the trusted publisher
environment:
name: publish-package
steps:
- name: Download distribution artifact
uses: actions/download-artifact@v4
with:
name: dist-artifact
path: dist
- name: List all files
run: ls -lh dist
- name: Verify sdist artifact attestation
# If publishing to TestPyPI or PyPI
if: >-
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe')
|| (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe')
|| (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe')
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh attestation verify dist/pylhe-*.tar.gz --repo ${{ github.repository }}
- name: Verify wheel artifact attestation
# If publishing to TestPyPI or PyPI
if: >-
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe')
|| (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe')
|| (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe')
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh attestation verify dist/pylhe-*.whl --repo ${{ github.repository }}
- name: Publish distribution 📦 to Test PyPI
# Publish to TestPyPI on tag events of if manually triggered
# Compare to 'true' string as booleans get turned into strings in the console
if: >-
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe')
|| (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe')
uses: pypa/[email protected]
with:
repository-url: https://test.pypi.org/legacy/
print-hash: true
attestations: true
- name: Publish distribution 📦 to PyPI
if: github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe'
uses: pypa/[email protected]
with:
print-hash: true
attestations: true