-
Notifications
You must be signed in to change notification settings - Fork 85
180 lines (158 loc) · 6.56 KB
/
publish-package.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
name: publish distributions
on:
push:
branches:
- main
tags:
- v*
pull_request:
branches:
- main
- release/v*
release:
types: [published]
# Run weekly at 1:23 UTC
schedule:
- cron: '23 1 * * 0'
workflow_dispatch:
inputs:
publish:
type: boolean
description: 'Publish to TestPyPI'
default: false
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
build:
name: Build Python distribution
runs-on: ubuntu-latest
permissions:
id-token: write
attestations: write
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Python 3.12
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Install python-build and twine
run: |
python -m pip install uv
uv pip install --system --upgrade pip
uv pip install --system build twine
python -m pip list
- name: Build a sdist and wheel
if: github.event_name != 'schedule'
run: |
python -m build --installer uv .
- name: Build a sdist and wheel and check for warnings
if: github.event_name == 'schedule'
run: |
PYTHONWARNINGS=error,default::DeprecationWarning python -m build --installer uv .
- name: Verify untagged commits have dev versions
if: "!startsWith(github.ref, 'refs/tags/')"
run: |
latest_tag=$(git describe --tags)
latest_tag_revlist_SHA=$(git rev-list -n 1 ${latest_tag})
main_SHA="$(git rev-parse --verify origin/main)"
wheel_name=$(find dist/ -iname "*.whl" -printf "%f\n")
if [[ "${latest_tag_revlist_SHA}" != "${main_SHA}" ]]; then # don't check main push events coming from tags
if [[ "${wheel_name}" == *"pyhf-0.1.dev"* || "${wheel_name}" != *"dev"* ]]; then
echo "python-build incorrectly named built distribution: ${wheel_name}"
echo "python-build is lacking the history and tags required to determine version number"
echo "intentionally erroring with 'return 1' now"
return 1
fi
else
echo "Push event to origin/main was triggered by push of tag ${latest_tag}"
fi
echo "python-build named built distribution: ${wheel_name}"
- name: Verify tagged commits don't have dev versions
if: startsWith(github.ref, 'refs/tags')
run: |
wheel_name=$(find dist/ -iname "*.whl" -printf "%f\n")
if [[ "${wheel_name}" == *"dev"* ]]; then
echo "python-build incorrectly named built distribution: ${wheel_name}"
echo "this is incorrrectly being treated as a dev release"
echo "intentionally erroring with 'return 1' now"
return 1
fi
echo "python-build named built distribution: ${wheel_name}"
- name: Verify the distribution
run: twine check --strict dist/*
- name: List contents of sdist
run: python -m tarfile --list dist/pyhf-*.tar.gz
- name: List contents of wheel
run: python -m zipfile --list dist/pyhf-*.whl
- name: Generate artifact attestation for sdist and wheel
# If publishing to TestPyPI or PyPI
if: >-
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pyhf')
|| (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pyhf')
|| (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pyhf')
uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
with:
subject-path: "dist/pyhf-*"
- name: Upload distribution artifact
uses: actions/[email protected]
with:
name: dist-artifact
path: dist
publish:
name: Publish Python distribution to (Test)PyPI
if: github.event_name != 'pull_request'
needs: build
runs-on: ubuntu-latest
# Mandatory for publishing with a trusted publisher
# c.f. https://docs.pypi.org/trusted-publishers/using-a-publisher/
permissions:
id-token: write
# Restrict to the environment set for the trusted publisher
environment:
name: publish-package
steps:
- name: Download distribution artifact
uses: actions/download-artifact@v4
with:
name: dist-artifact
path: dist
- name: List all files
run: ls -lh dist
- name: Verify sdist artifact attestation
# If publishing to TestPyPI or PyPI
if: >-
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pyhf')
|| (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pyhf')
|| (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pyhf')
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh attestation verify dist/pyhf-*.tar.gz --repo ${{ github.repository }}
- name: Verify wheel artifact attestation
# If publishing to TestPyPI or PyPI
if: >-
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pyhf')
|| (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pyhf')
|| (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pyhf')
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh attestation verify dist/pyhf-*.whl --repo ${{ github.repository }}
- name: Publish distribution 📦 to Test PyPI
# Publish to TestPyPI on tag events of if manually triggered
# Compare to 'true' string as booleans get turned into strings in the console
if: >-
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pyhf')
|| (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pyhf')
uses: pypa/[email protected]
with:
repository-url: https://test.pypi.org/legacy/
print-hash: true
- name: Publish distribution 📦 to PyPI
if: github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pyhf'
uses: pypa/[email protected]
with:
print-hash: true