ci: publish to PyPI and TestPyPI via trusted publishing - #92
Merged
Conversation
Add publish-pypi (on v* tags, after the GitHub Release) and publish-testpypi (workflow_dispatch dry run) jobs that upload the same built artifacts using OIDC trusted publishing and GitHub environments; no API tokens in secrets. Add a check-version job that refuses a tag whose name does not match the package version or when pyproject.toml, Cargo.toml and __init__.py disagree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds PyPI publishing to the release workflow so GitHub Releases and PyPI ship the same bytes from one build.
publish-pypi— runs onv*tags, afterpublish-release, uploads the downloaded wheels + sdist to https://pypi.org/p/glyf-core withpypa/gh-action-pypi-publishvia OIDC trusted publishing (environment: pypi,id-token: write). No PyPI tokens in secrets.publish-testpypi—workflow_dispatchwith the newpublish_to_testpypiinput: full build, then upload to TestPyPI (environment: testpypi,skip-existing). Dispatching without the input just exercises the build matrix.check-version— first job; fails ifpyproject.toml,Cargo.toml, andsrc/glyf/__init__.pydisagree, or if a tagvX.Y.Zdoesn't match the package version.twine check --strictbefore every upload.docs/release.mddocuments the dry run and the one-time trusted-publisher setup.Design note: PyPI's docs state reusable workflows can't be used as a trusted publisher, so the publish jobs live in
release.ymlrather than a separatepypi.yml; the trusted publisher on PyPI/TestPyPI must be registered with workflow namerelease.yml.One-time setup still needed (outside this PR)
pypiandtestpypiare created on the repo already.glyf-core— ownerglyf-data, repoglyf, workflowrelease.yml, environmentpypi/testpypi.Verification
check-version → build-wheels/build-sdist → publish-release → publish-pypi,publish-testpypioffbuild-*on dispatch only.pyproject=0.3.0 cargo=0.3.0 init=0.3.0.