action.yml

name: PyPI Deployment
author: Casper da Costa-Luis
description: Securely build and upload Python distributions to PyPI
inputs:
  user:
    description: PyPI username
    required: false
    default: __token__
  password:
    description: PyPI password or API token
    required: false
  registry_domain:
    description: PyPI trusted publisher URL
    required: false
    default: https://upload.pypi.org
  requirements:
    description: Packages to `pip install` before building
    required: false
    default: twine wheel build
  setup:
    description: '`setup.py` command to run ("true" is a shortcut for "clean sdist -d <dist_dir> bdist_wheel -d <dist_dir>")'
    required: false
    default: false
  build:
    description: '`python -m build` command to run ("true" is a shortcut for "-o <dist_dir>")'
    required: false
    default: false
  pip:
    description: '`pip` command to run ("true" is a shortcut for "wheel -w <dist_dir> --no-deps .")'
    required: false
    default: false
  check:
    description: Whether to run basic checks on the built files
    required: false
    default: true
  upload:
    description: Whether to upload
    required: false
    default: true
  dist_dir:
    description: Directory containing distributions
    required: false
    default: dist
  url:
    description: Destination repository (package index) URL
    required: false
    default: ''
  gpg_key:
    description: GPG key to import for signing
    required: false
    default: ''
  skip_existing:
    description: Continue uploading files if one already exists
    required: false
    default: false
outputs:
  whl:
    description: Basename of *.whl for upload
    value: ${{ steps.upload.outputs.whl }}
  targz:
    description: Basename of *.tar.gz for upload
    value: ${{ steps.upload.outputs.targz }}
  whl_asc:
    description: Basename of *.whl.asc for upload (requires <gpg_key>)
    value: ${{ steps.upload.outputs.whl_asc }}
  targz_asc:
    description: Basename of *.tar.gz.asc for upload (requires <gpg_key>)
    value: ${{ steps.upload.outputs.targz_asc }}
runs:
  using: composite
  steps:
    - name: build
      run: |
        if [[ -n "$INPUT_REQUIREMENTS" && "$INPUT_SETUP$INPUT_BUILD$INPUT_PIP" != falsefalsefalse ]]; then
          python -m pip install $INPUT_REQUIREMENTS
        fi
        if [[ "$INPUT_PIP" == true ]]; then
          python -m pip wheel -w "$INPUT_DIST_DIR" --no-deps .
        elif [[ "$INPUT_PIP" != false ]]; then
          python -m pip $INPUT_PIP
        fi
        if [[ "$INPUT_BUILD" == build* || "$INPUT_BUILD" == [bs]dist* || "$INPUT_BUILD" == clean* ]]; then
          echo '::warning title=deploy-pypi::assuming `with.setup` instead of `with.build`'
          python setup.py $INPUT_BUILD
        elif [[ "$INPUT_BUILD" == true ]]; then
          python -m pip install build
          python -m build -o "$INPUT_DIST_DIR"
        elif [[ "$INPUT_BUILD" != false ]]; then
          python -m pip install build
          python -m build $INPUT_BUILD
        fi
        if [[ "$INPUT_SETUP" == true ]]; then
          python setup.py sdist -d "$INPUT_DIST_DIR" bdist_wheel -d "$INPUT_DIST_DIR"
        elif [[ "$INPUT_SETUP" != false ]]; then
          python setup.py $INPUT_SETUP
        fi
      shell: bash
      env:
        INPUT_REQUIREMENTS: ${{ inputs.requirements }}
        INPUT_SETUP: ${{ inputs.setup }}
        INPUT_BUILD: ${{ inputs.build }}
        INPUT_PIP: ${{ inputs.pip }}
        INPUT_DIST_DIR: ${{ inputs.dist_dir }}
    - name: check
      run: |
        if [[ "$INPUT_CHECK" == true ]]; then
          python -m pip install twine
          python -m twine check "${INPUT_DIST_DIR%%/}"/*
        fi
      shell: bash
      env:
        INPUT_DIST_DIR: ${{ inputs.dist_dir }}
        INPUT_CHECK: ${{ inputs.check }}
    - id: upload
      name: upload
      run: |
        DIST="${INPUT_DIST_DIR%%/}"
        if [[ "$INPUT_UPLOAD" == true ]]; then
          TWINE_OPTS=""
          if [[ -n "$INPUT_GPG_KEY" ]]; then
            gpg --import <(echo "$INPUT_GPG_KEY")
            TWINE_OPTS="$TWINE_OPTS -s --sign-with gpg"
          fi
          if [[ "$INPUT_SKIP_EXISTING" == true ]]; then
            TWINE_OPTS="$TWINE_OPTS --skip-existing"
          fi
          python -m pip install twine
          if [[ -z "$TWINE_PASSWORD" ]]; then
            # vis https://docs.pypi.org/trusted-publishers/using-a-publisher/#the-manual-way
            oidc_token=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=pypi" | jq -r '.value')
            export TWINE_PASSWORD=$(curl $INPUT_REGISTRY_DOMAIN/_/oidc/mint-token -d "{\"token\": \"${oidc_token}\"}" | jq -r '.token')
            echo "::add-mask::$TWINE_PASSWORD"
          fi
          python -m twine upload $TWINE_OPTS "${DIST}"/*
        fi
        pushd "$DIST"
        echo "whl=$(ls *.whl || :)" >> $GITHUB_OUTPUT
        echo "whl_asc=$(ls *.whl.asc || :)" >> $GITHUB_OUTPUT
        echo "targz=$(ls *.tar.gz || :)" >> $GITHUB_OUTPUT
        echo "targz_asc=$(ls *.tar.gz.asc || :)" >> $GITHUB_OUTPUT
        popd
      shell: bash
      env:
        INPUT_UPLOAD: ${{ inputs.upload }}
        INPUT_DIST_DIR: ${{ inputs.dist_dir }}
        INPUT_GPG_KEY: ${{ inputs.gpg_key }}
        INPUT_SKIP_EXISTING: ${{ inputs.skip_existing }}
        TWINE_REPOSITORY_URL: ${{ inputs.url }}
        TWINE_USERNAME: ${{ inputs.user }}
        TWINE_PASSWORD: ${{ inputs.password }}
        INPUT_REGISTRY_DOMAIN: ${{ inputs.registry_domain }}
branding:
  icon: upload-cloud
  color: blue