Skip to content

Commit 9734f77

Browse files
browniebrokebrowniebroke
authored
Setup release workflow with trusted publisher (#9852)
1 parent bb76622 commit 9734f77

File tree

2 files changed

+135
-7
lines changed

2 files changed

+135
-7
lines changed

‎.github/workflows/release.yml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
name: Publish Release
2+
3+
concurrency:
4+
# stop previous release runs if tag is recreated
5+
group: release-${{ github.ref }}
6+
cancel-in-progress: true
7+
8+
on:
9+
push:
10+
tags:
11+
# Order matters, the last rule that applies to a tag
12+
# is the one that takes effect:
13+
# https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#example-including-and-excluding-branches-and-tags
14+
- '*.*.*'
15+
# There should be no dev tags created, but to be safe,
16+
# let's not publish them.
17+
- '!*.*.*.dev*'
18+
19+
env:
20+
PYPI_URL: https://pypi.org/p/djangorestframework
21+
PYPI_TEST_URL: https://test.pypi.org/p/djangorestframework
22+
23+
jobs:
24+
build:
25+
name: Build distribution 📦
26+
runs-on: ubuntu-24.04
27+
steps:
28+
- uses: actions/checkout@v6
29+
- name: Set up Python
30+
uses: actions/setup-python@v6
31+
with:
32+
python-version: "3.x"
33+
- name: Install pypa/build
34+
run: python3 -m pip install build
35+
- name: Build a binary wheel and a source tarball
36+
run: python3 -m build
37+
- name: Store the distribution packages
38+
uses: actions/upload-artifact@v7
39+
with:
40+
name: python-package-distributions
41+
path: dist/
42+
43+
publish-to-testpypi:
44+
name: Publish Python 🐍 distribution 📦 to TestPyPI
45+
needs:
46+
- build
47+
runs-on: ubuntu-24.04
48+
environment:
49+
name: testpypi
50+
url: ${{ env.PYPI_TEST_URL }}
51+
permissions:
52+
id-token: write # IMPORTANT: mandatory for trusted publishing
53+
steps:
54+
- name: Download all the dists
55+
uses: actions/download-artifact@v8
56+
with:
57+
name: python-package-distributions
58+
path: dist/
59+
- name: Publish distribution 📦 to TestPyPI
60+
uses: pypa/gh-action-pypi-publish@release/v1.13
61+
with:
62+
repository-url: https://test.pypi.org/legacy/
63+
skip-existing: true
64+
65+
publish-to-pypi:
66+
name: Publish Python 🐍 distribution 📦 to PyPI
67+
needs:
68+
- build
69+
- publish-to-testpypi
70+
runs-on: ubuntu-24.04
71+
environment:
72+
name: pypi
73+
url: ${{ env.PYPI_URL }}
74+
permissions:
75+
id-token: write # IMPORTANT: mandatory for trusted publishing
76+
steps:
77+
- name: Download all the dists
78+
uses: actions/download-artifact@v8
79+
with:
80+
name: python-package-distributions
81+
path: dist/
82+
- name: Publish distribution 📦 to PyPI
83+
uses: pypa/gh-action-pypi-publish@release/v1.13
84+
85+
github-release:
86+
name: >-
87+
Sign the Python 🐍 distribution 📦 with Sigstore
88+
and upload them to GitHub Release
89+
needs:
90+
- publish-to-pypi
91+
runs-on: ubuntu-24.04
92+
permissions:
93+
contents: write # IMPORTANT: mandatory for making GitHub Releases
94+
id-token: write # IMPORTANT: mandatory for sigstore
95+
steps:
96+
- name: Download all the dists
97+
uses: actions/download-artifact@v8
98+
with:
99+
name: python-package-distributions
100+
path: dist/
101+
- name: Sign the dists with Sigstore
102+
uses: sigstore/gh-action-sigstore-python@v3.2.0
103+
with:
104+
inputs: >-
105+
./dist/*.tar.gz
106+
./dist/*.whl
107+
- name: Create GitHub Release
108+
env:
109+
GITHUB_TOKEN: ${{ github.token }}
110+
run: >-
111+
gh release create
112+
'${{ github.ref_name }}'
113+
--repo '${{ github.repository }}'
114+
--generate-notes
115+
- name: Upload artifact signatures to GitHub Release
116+
env:
117+
GITHUB_TOKEN: ${{ github.token }}
118+
# Upload to GitHub Release using the `gh` CLI.
119+
# `dist/` contains the built packages, and the
120+
# sigstore-produced signatures and certificates.
121+
run: >-
122+
gh release upload
123+
'${{ github.ref_name }}' dist/**
124+
--repo '${{ github.repository }}'

‎docs/community/project-management.md‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -60,19 +60,23 @@ The following template should be used for the description of the issue, and serv
6060
- [ ] `README` Python & Django versions
6161
- [ ] `docs` Python & Django versions
6262
- [ ] Ensure the pull request increments the version to `*.*.*` in [`restframework/__init__.py`](https://github.com/encode/django-rest-framework/blob/main/rest_framework/__init__.py).
63+
- [ ] Update the release-notes.md:
64+
- Start drafting a new release in GitHub: https://github.com/encode/django-rest-framework/releases/new
65+
- Select the tag that you want to give to the next release and the previous tag
66+
- Click the "Generate release notes" button
67+
- Don't confirm anything yet! Copy the generated content to a file `input.md`
68+
- Run `uv tool run linkify-gh-markdown input.md` to make the links absolute
69+
- Put the generated content in the release-notes.md file
6370
- [ ] Ensure documentation validates
6471
- Build and serve docs `mkdocs serve`
6572
- Validate links `pylinkvalidate.py -P http://127.0.0.1:8000`
66-
- [ ] Confirm with @tomchristie that release is finalized and ready to go.
73+
- [ ] Confirm with other maintainers that the release is finalized and ready to go.
6774
- [ ] Ensure that release date is included in pull request.
6875
- [ ] Merge the release pull request.
69-
- [ ] Install the release tools: `pip install build twine`
70-
- [ ] Build the package: `python -m build`
71-
- [ ] Push the package to PyPI with `twine upload dist/*`
72-
- [ ] Tag the release, with `git tag -a *.*.* -m 'version *.*.*'; git push --tags`.
73-
- [ ] Deploy the documentation with `mkdocs gh-deploy`.
76+
- [ ] Tag the release, either with `git tag -a *.*.* -m 'version *.*.*'; git push --tags` or in GitHub.
77+
- [ ] Wait for the release workflow to run. It will build the distribution, upload it to Test PyPI, PyPI and create the GitHub release.
7478
- [ ] Make a release announcement on the [discussion group](https://groups.google.com/forum/?fromgroups#!forum/django-rest-framework).
75-
- [ ] Make a release announcement on twitter.
79+
- [ ] Make a release announcement on social media (Mastodon, etc...) and on the [Django forum](https://forum.djangoproject.com/).
7680
- [ ] Close the milestone on GitHub.
7781

7882
To modify this process for future releases make a pull request to the [project management](https://www.django-rest-framework.org/topics/project-management/) documentation.

0 commit comments

Comments
 (0)