Skip to content

Commit 80f5f24

Browse files
Fermionic-LyuFermionic-Lyu
authored
Merge pull request #4 from InsForge/codex/add-pypi-publish
ci: publish Python SDK with trusted publishing
2 parents d569e7d + 6664980 commit 80f5f24

4 files changed

Lines changed: 159 additions & 12 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 37 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,20 @@ on:
66
pull_request:
77
branches: [main]
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
unit-tests:
1114
name: Unit Tests
1215
runs-on: ubuntu-latest
1316
strategy:
1417
matrix:
15-
python-version: ["3.11", "3.12", "3.13"]
18+
python-version: ["3.11", "3.12", "3.13", "3.14"]
1619
steps:
17-
- uses: actions/checkout@v4
20+
- uses: actions/checkout@v7
1821

19-
- uses: actions/setup-python@v5
22+
- uses: actions/setup-python@v6
2023
with:
2124
python-version: ${{ matrix.python-version }}
2225

@@ -28,15 +31,44 @@ jobs:
2831
- name: Run unit tests
2932
run: python -m pytest tests/ --ignore=tests/test_integration.py -v
3033

34+
package:
35+
name: Package
36+
runs-on: ubuntu-latest
37+
steps:
38+
- uses: actions/checkout@v7
39+
40+
- uses: actions/setup-python@v6
41+
with:
42+
python-version: "3.11"
43+
44+
- name: Install build tools
45+
run: python -m pip install --upgrade build twine
46+
47+
- name: Check Python syntax
48+
run: python -m compileall -q insforge tests
49+
50+
- name: Build distributions
51+
run: python -m build
52+
53+
- name: Check distribution metadata
54+
run: python -m twine check dist/*
55+
56+
- name: Smoke test wheel
57+
run: |
58+
python -m venv /tmp/insforge-wheel-test
59+
/tmp/insforge-wheel-test/bin/python -m pip install dist/*.whl
60+
cd /tmp
61+
/tmp/insforge-wheel-test/bin/python -c 'import insforge; from importlib.metadata import version; print(version("insforge"))'
62+
3163
integration-tests:
3264
name: Integration Tests
3365
runs-on: ubuntu-latest
3466
needs: unit-tests
3567
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
3668
steps:
37-
- uses: actions/checkout@v4
69+
- uses: actions/checkout@v7
3870

39-
- uses: actions/setup-python@v5
71+
- uses: actions/setup-python@v6
4072
with:
4173
python-version: "3.13"
4274

‎.github/workflows/publish.yml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
name: Publish to PyPI
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*"
7+
8+
permissions:
9+
contents: read
10+
11+
concurrency:
12+
group: pypi-${{ github.ref }}
13+
cancel-in-progress: false
14+
15+
jobs:
16+
build:
17+
name: Build distributions
18+
runs-on: ubuntu-latest
19+
outputs:
20+
stable: ${{ steps.version.outputs.stable }}
21+
steps:
22+
- uses: actions/checkout@v7
23+
24+
- uses: actions/setup-python@v6
25+
with:
26+
python-version: "3.11"
27+
28+
- name: Validate tag matches package version
29+
id: version
30+
env:
31+
RELEASE_TAG: ${{ github.ref_name }}
32+
run: |
33+
package_version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
34+
if [ "$RELEASE_TAG" != "v$package_version" ]; then
35+
echo "Tag $RELEASE_TAG does not match package version $package_version."
36+
exit 1
37+
fi
38+
39+
if [[ "$package_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
40+
echo "stable=true" >> "$GITHUB_OUTPUT"
41+
else
42+
echo "stable=false" >> "$GITHUB_OUTPUT"
43+
fi
44+
45+
- name: Install test and build tools
46+
run: |
47+
python -m pip install --upgrade -e .
48+
python -m pip install --upgrade pytest pytest-asyncio build twine
49+
50+
- name: Run unit tests
51+
run: python -m pytest tests/ --ignore=tests/test_integration.py -v
52+
53+
- name: Build distributions
54+
run: python -m build
55+
56+
- name: Check distribution metadata
57+
run: python -m twine check dist/*
58+
59+
- name: Smoke test wheel
60+
run: |
61+
python -m venv /tmp/insforge-wheel-test
62+
/tmp/insforge-wheel-test/bin/python -m pip install dist/*.whl
63+
cd /tmp
64+
/tmp/insforge-wheel-test/bin/python -c 'import insforge; from importlib.metadata import version; print(version("insforge"))'
65+
66+
- name: Upload distributions
67+
uses: actions/upload-artifact@v7
68+
with:
69+
name: python-package-distributions
70+
path: dist/
71+
if-no-files-found: error
72+
retention-days: 1
73+
74+
publish:
75+
name: Publish distributions
76+
needs: build
77+
runs-on: ubuntu-latest
78+
permissions:
79+
id-token: write
80+
steps:
81+
- name: Download distributions
82+
uses: actions/download-artifact@v8
83+
with:
84+
name: python-package-distributions
85+
path: dist/
86+
87+
- name: Publish to PyPI
88+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
89+
90+
release:
91+
name: Create stable GitHub Release
92+
if: needs.build.outputs.stable == 'true'
93+
needs: [build, publish]
94+
runs-on: ubuntu-latest
95+
permissions:
96+
contents: write
97+
98+
steps:
99+
- name: Create GitHub Release
100+
env:
101+
GH_TOKEN: ${{ github.token }}
102+
RELEASE_TAG: ${{ github.ref_name }}
103+
REPOSITORY: ${{ github.repository }}
104+
run: |
105+
if gh release view "$RELEASE_TAG" --repo "$REPOSITORY" >/dev/null 2>&1; then
106+
echo "GitHub Release $RELEASE_TAG already exists"
107+
else
108+
gh release create "$RELEASE_TAG" --repo "$REPOSITORY" --generate-notes --verify-tag
109+
fi

‎README.md‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -257,18 +257,20 @@ python -m build
257257

258258
This produces `dist/insforge-<version>.tar.gz` and `dist/insforge-<version>-py3-none-any.whl`.
259259

260-
### Publish to PyPI
260+
### Release to PyPI
261261

262-
```bash
263-
pip install twine
262+
Publishing uses PyPI Trusted Publishing through `.github/workflows/publish.yml`; no PyPI API token is stored in GitHub. The workflow publishes both the wheel and source distribution and produces digital attestations.
264263

265-
# Test PyPI (recommended first)
266-
twine upload --repository testpypi dist/*
264+
1. Update `project.version` in `pyproject.toml` and merge the change to `main` after CI passes.
265+
2. Create and push an annotated tag that exactly matches the package version with a `v` prefix:
267266

268-
# Production PyPI
269-
twine upload dist/*
267+
```bash
268+
git tag -a vX.Y.Z -m "vX.Y.Z"
269+
git push origin vX.Y.Z
270270
```
271271

272+
The tag triggers a build, metadata validation, and publication to PyPI. PEP 440 prerelease versions are supported as long as the tag exactly matches the version in `pyproject.toml`. After PyPI publication succeeds, stable `X.Y.Z` versions create a GitHub Release automatically; prerelease tags do not.
273+
272274
## License
273275

274276
See [LICENSE](LICENSE) for details.

‎pyproject.toml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ dependencies = [
1313
"pydantic>=2.0",
1414
]
1515

16+
[project.urls]
17+
Source = "https://github.com/InsForge/insforge-python"
18+
Issues = "https://github.com/InsForge/insforge-python/issues"
19+
1620
[tool.setuptools]
1721
packages = [
1822
"insforge",

0 commit comments

Comments
 (0)