From 1242ddd4e2ae565ec6ff48ee95624074c8f66dc6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= Date: Thu, 12 Oct 2023 14:04:54 +0200 Subject: [PATCH] Setup trusted publishing to PyPI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: AurΓ©lien Bompard --- .github/workflows/main.yml | 155 ++++++++++++++++++++++++++++++++++++ .github/workflows/tests.yml | 51 ------------ 2 files changed, 155 insertions(+), 51 deletions(-) create mode 100644 .github/workflows/main.yml delete mode 100644 .github/workflows/tests.yml diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml new file mode 100644 index 0000000..5f7c519 --- /dev/null +++ b/.github/workflows/main.yml @@ -0,0 +1,155 @@ +on: + push: + branches: + - develop + pull_request: + branches: + - develop + +name: Run Tox tests + +jobs: + misc_tests: + name: Misc tests + steps: + - uses: actions/checkout@v4 + - name: Run tests + uses: fedora-python/tox-github-action@main + with: + tox_env: ${{ matrix.tox_env }} + strategy: + matrix: + tox_env: + - lint + - format + - security + runs-on: ubuntu-latest + + unit_test: + name: Unit tests + steps: + - uses: actions/checkout@v4 + - name: Run tests + uses: fedora-python/tox-github-action@main + with: + tox_env: ${{ matrix.tox_env }} + - name: Upload coverage to Codecov + uses: codecov/codecov-action@v3 + with: + name: ${{ matrix.tox_env }} + flags: unittests + env_vars: PYTHON + fail_ci_if_error: true + strategy: + matrix: + tox_env: + - py37 + - py38 + - py39 + - py310 + - flask1 + runs-on: ubuntu-latest + + # https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ + build: + name: Build distribution πŸ“¦ + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: "3.x" + - name: Install pypa/build + run: python3 -m pip install build --user + - name: Build a binary wheel and a source tarball + run: python3 -m build + - name: Store the distribution packages + uses: actions/upload-artifact@v3 + with: + name: python-package-distributions + path: dist/ + + publish-to-pypi: + name: Publish Python 🐍 distribution πŸ“¦ to PyPI + if: startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes + needs: + - build + - unit_test + - misc_test + runs-on: ubuntu-latest + environment: + name: pypi + url: https://pypi.org/p/flask-healthz + permissions: + id-token: write # IMPORTANT: mandatory for trusted publishing + steps: + - name: Download all the dists + uses: actions/download-artifact@v3 + with: + name: python-package-distributions + path: dist/ + - name: Publish distribution πŸ“¦ to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 + + github-release: + name: >- + Sign the Python 🐍 distribution πŸ“¦ with Sigstore + and upload them to GitHub Release + needs: + - publish-to-pypi + runs-on: ubuntu-latest + + permissions: + contents: write # IMPORTANT: mandatory for making GitHub Releases + id-token: write # IMPORTANT: mandatory for sigstore + + steps: + - name: Download all the dists + uses: actions/download-artifact@v3 + with: + name: python-package-distributions + path: dist/ + - name: Sign the dists with Sigstore + uses: sigstore/gh-action-sigstore-python@v1.2.3 + with: + inputs: >- + ./dist/*.tar.gz + ./dist/*.whl + - name: Upload artifact signatures to GitHub Release + env: + GITHUB_TOKEN: ${{ github.token }} + # Upload to GitHub Release using the `gh` CLI. + # `dist/` contains the built packages, and the + # sigstore-produced signatures and certificates. + run: >- + gh release upload + '${{ github.ref_name }}' dist/** + --repo '${{ github.repository }}' + + publish-to-testpypi: + name: Publish Python 🐍 distribution πŸ“¦ to TestPyPI + needs: + - build + - unit_test + - misc_test + runs-on: ubuntu-latest + + environment: + name: testpypi + url: https://test.pypi.org/p/flask-healthz + + permissions: + id-token: write # IMPORTANT: mandatory for trusted publishing + + steps: + - name: Download all the dists + uses: actions/download-artifact@v3 + with: + name: python-package-distributions + path: dist/ + - name: Publish distribution πŸ“¦ to TestPyPI + uses: pypa/gh-action-pypi-publish@release/v1 + with: + repository-url: https://test.pypi.org/legacy/ diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml deleted file mode 100644 index 923241f..0000000 --- a/.github/workflows/tests.yml +++ /dev/null @@ -1,51 +0,0 @@ -on: - push: - branches: - - develop - pull_request: - branches: - - develop - -name: Run Tox tests - -jobs: - misc_tests: - name: Misc tests - steps: - - uses: actions/checkout@v4 - - name: Run tests - uses: fedora-python/tox-github-action@main - with: - tox_env: ${{ matrix.tox_env }} - strategy: - matrix: - tox_env: - - lint - - format - - security - runs-on: ubuntu-latest - - unit_test: - name: Unit tests - steps: - - uses: actions/checkout@v4 - - name: Run tests - uses: fedora-python/tox-github-action@main - with: - tox_env: ${{ matrix.tox_env }} - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v3 - with: - name: ${{ matrix.tox_env }} - flags: unittests - env_vars: PYTHON - fail_ci_if_error: true - strategy: - matrix: - tox_env: - - py37 - - py38 - - py39 - - py310 - - flask1 - runs-on: ubuntu-latest