@@ -4,125 +4,125 @@ name: Publish Python Package
44on :
55 push :
66 tags :
7- - ' v[0-9]+.[0-9]+.[0-9]*'
7+ - " v[0-9]+.[0-9]+.[0-9]*"
88
99jobs :
1010 build :
1111 name : Build distribution
1212 runs-on : ubuntu-latest
1313
1414 steps :
15- - uses : actions/checkout@v4
16- # NOTE: tags are not present unless triggered by tag push
17- # - name: Get tags
18- # run: git fetch --tags origin
19- # - name: List tags
20- # run: git tag --list
21- # TODO: somehow versioneer does not pickup the tag when workflow is not triggered by a
22- # tag push, getting e.g. (for sister repo scantree) scantree-0+untagged.1.gd74b1d5,
23- # see: https://github.com/andhus/scantree/actions/runs/7485873305/job/20375116541#step:7:42)
24- - name : Set up Python
25- uses : actions/setup-python@v5
26- with :
27- python-version : " 3.x"
28- - name : Install pypa/build
29- run : >-
30- python3 -m
31- pip install
32- build
33- --user
34- - name : Build a binary wheel and a source tarball
35- run : python3 -m build
36- - name : Store the distribution packages
37- uses : actions/upload-artifact@v4
38- with :
39- name : python-package-distributions
40- path : dist/
15+ - uses : actions/checkout@v4
16+ # NOTE: tags are not present unless triggered by tag push
17+ # - name: Get tags
18+ # run: git fetch --tags origin
19+ # - name: List tags
20+ # run: git tag --list
21+ # TODO: somehow versioneer does not pickup the tag when workflow is not triggered by a
22+ # tag push, getting e.g. (for sister repo scantree) scantree-0+untagged.1.gd74b1d5,
23+ # see: https://github.com/andhus/scantree/actions/runs/7485873305/job/20375116541#step:7:42)
24+ - name : Set up Python
25+ uses : actions/setup-python@v5
26+ with :
27+ python-version : " 3.x"
28+ - name : Install pypa/build
29+ run : >-
30+ python3 -m
31+ pip install
32+ build
33+ --user
34+ - name : Build a binary wheel and a source tarball
35+ run : python3 -m build
36+ - name : Store the distribution packages
37+ uses : actions/upload-artifact@v4
38+ with :
39+ name : python-package-distributions
40+ path : dist/
4141
4242 publish-to-pypi :
4343 name : Publish to PyPI
4444 # TODO we need to make sure the tag matches the version!
45- if : startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes
45+ if : startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes
4646 needs :
47- - build
47+ - build
4848 runs-on : ubuntu-latest
4949 environment :
5050 name : pypi
5151 url : https://pypi.org/p/dirhash
5252 permissions :
53- id-token : write # IMPORTANT: mandatory for trusted publishing
53+ id-token : write # IMPORTANT: mandatory for trusted publishing
5454
5555 steps :
56- - name : Download all the dists
57- uses : actions/download-artifact@v4
58- with :
59- name : python-package-distributions
60- path : dist/
61- - name : Publish distribution 📦 to PyPI
62- uses : pypa/gh-action-pypi-publish@release/v1
56+ - name : Download all the dists
57+ uses : actions/download-artifact@v4
58+ with :
59+ name : python-package-distributions
60+ path : dist/
61+ - name : Publish distribution 📦 to PyPI
62+ uses : pypa/gh-action-pypi-publish@release/v1
6363
6464 github-release :
6565 name : Sign and upload to GitHub Release
6666 needs :
67- - publish-to-pypi
67+ - publish-to-pypi
6868 runs-on : ubuntu-latest
6969
7070 permissions :
71- contents : write # IMPORTANT: mandatory for making GitHub Releases
72- id-token : write # IMPORTANT: mandatory for sigstore
71+ contents : write # IMPORTANT: mandatory for making GitHub Releases
72+ id-token : write # IMPORTANT: mandatory for sigstore
7373
7474 steps :
75- - name : Download all the dists
76- uses : actions/download-artifact@v4
77- with :
78- name : python-package-distributions
79- path : dist/
80- - name : Sign the dists with Sigstore
81- uses : sigstore/gh-action-sigstore-python@v2.1.1
82- with :
83- inputs : >-
84- ./dist/*.tar.gz
85- ./dist/*.whl
86- - name : Create GitHub Release
87- env :
88- GITHUB_TOKEN : ${{ github.token }}
89- run : >-
90- gh release create
91- '${{ github.ref_name }}'
92- --repo '${{ github.repository }}'
93- --notes ""
94- - name : Upload artifact signatures to GitHub Release
95- env :
96- GITHUB_TOKEN : ${{ github.token }}
97- # Upload to GitHub Release using the `gh` CLI.
98- # `dist/` contains the built packages, and the
99- # sigstore-produced signatures and certificates.
100- run : >-
101- gh release upload
102- '${{ github.ref_name }}' dist/**
103- --repo '${{ github.repository }}'
75+ - name : Download all the dists
76+ uses : actions/download-artifact@v4
77+ with :
78+ name : python-package-distributions
79+ path : dist/
80+ - name : Sign the dists with Sigstore
81+ uses : sigstore/gh-action-sigstore-python@v2.1.1
82+ with :
83+ inputs : >-
84+ ./dist/*.tar.gz
85+ ./dist/*.whl
86+ - name : Create GitHub Release
87+ env :
88+ GITHUB_TOKEN : ${{ github.token }}
89+ run : >-
90+ gh release create
91+ '${{ github.ref_name }}'
92+ --repo '${{ github.repository }}'
93+ --notes ""
94+ - name : Upload artifact signatures to GitHub Release
95+ env :
96+ GITHUB_TOKEN : ${{ github.token }}
97+ # Upload to GitHub Release using the `gh` CLI.
98+ # `dist/` contains the built packages, and the
99+ # sigstore-produced signatures and certificates.
100+ run : >-
101+ gh release upload
102+ '${{ github.ref_name }}' dist/**
103+ --repo '${{ github.repository }}'
104104
105105 publish-to-testpypi :
106106 name : Publish to TestPyPI
107- if : startsWith(github.ref, 'refs/tags/') # only publish on tag pushes
107+ if : startsWith(github.ref, 'refs/tags/') # only publish on tag pushes
108108 needs :
109- - build
109+ - build
110110 runs-on : ubuntu-latest
111111
112112 environment :
113113 name : testpypi
114114 url : https://test.pypi.org/p/dirhash
115115
116116 permissions :
117- id-token : write # IMPORTANT: mandatory for trusted publishing
117+ id-token : write # IMPORTANT: mandatory for trusted publishing
118118
119119 steps :
120- - name : Download all the dists
121- uses : actions/download-artifact@v4
122- with :
123- name : python-package-distributions
124- path : dist/
125- - name : Publish distribution 📦 to TestPyPI
126- uses : pypa/gh-action-pypi-publish@release/v1
127- with :
128- repository-url : https://test.pypi.org/legacy/
120+ - name : Download all the dists
121+ uses : actions/download-artifact@v4
122+ with :
123+ name : python-package-distributions
124+ path : dist/
125+ - name : Publish distribution 📦 to TestPyPI
126+ uses : pypa/gh-action-pypi-publish@release/v1
127+ with :
128+ repository-url : https://test.pypi.org/legacy/
0 commit comments