-
Notifications
You must be signed in to change notification settings - Fork 228
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Deploy via a protected environment and using PyPI trusted publishers (#…
…902) Following recent discussions, this changes the development process as follows: 1. The deploy is now manually triggered after the release PR is approved. 2. The deploy workflow tags the repository only after the package has been published to PyPI. 3. Use PyPI trusted publishers instead of API tokens. Co-authored-by: Ran Benita <ran@unusedvar.com>
- Loading branch information
1 parent
be1d5c4
commit 37b9dbd
Showing
2 changed files
with
38 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,33 +1,47 @@ | ||
name: deploy | ||
|
||
on: | ||
push: | ||
tags: | ||
- "v*" | ||
workflow_dispatch: | ||
inputs: | ||
version: | ||
description: 'Release version' | ||
required: true | ||
default: '1.2.3' | ||
|
||
jobs: | ||
deploy: | ||
|
||
package: | ||
runs-on: ubuntu-latest | ||
env: | ||
SETUPTOOLS_SCM_PRETEND_VERSION: ${{ github.event.inputs.version }} | ||
|
||
steps: | ||
- uses: actions/checkout@v3 | ||
|
||
- name: Build and Check Package | ||
uses: hynek/build-and-inspect-python-package@v1.5 | ||
|
||
deploy: | ||
needs: package | ||
runs-on: ubuntu-latest | ||
environment: deploy | ||
permissions: | ||
id-token: write # For PyPI trusted publishers. | ||
contents: write # For tag. | ||
|
||
steps: | ||
- uses: actions/checkout@v3 | ||
|
||
- name: Download Package | ||
uses: actions/download-artifact@v3 | ||
with: | ||
# Needed to fetch tags, which are required by setuptools-scm. | ||
fetch-depth: 0 | ||
- name: Set up Python | ||
uses: actions/setup-python@v2 | ||
with: | ||
python-version: "3.10" | ||
- name: Install build | ||
run: | | ||
python -m pip install --upgrade pip | ||
pip install build | ||
- name: Build package | ||
run: | | ||
python -m build | ||
name: Packages | ||
path: dist | ||
|
||
- name: Publish package to PyPI | ||
uses: pypa/gh-action-pypi-publish@release/v1 | ||
with: | ||
user: __token__ | ||
password: ${{ secrets.pypi_token }} | ||
uses: pypa/gh-action-pypi-publish@v1.8.5 | ||
|
||
- name: Push tag | ||
run: | | ||
git tag --annotate --message=v${{ github.event.inputs.version }} v${{ github.event.inputs.version }} ${{ github.sha }} | ||
git push origin v${{ github.event.inputs.version }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters