Skip to content

v0.7.0

v0.7.0: Modernise PyPI publish workflow and CI action pins
@wwood wwood tagged this 31 Aug 07:25 
The publish workflow still used Node 16-era actions (checkout@v2,
setup-python@v2) and the unmaintained third-party casperdcl/deploy-pypi
action with a PYPI_API_TOKEN secret.

- Split into build and publish jobs; build with `python -m build` and
  gate on `twine check --strict`.
- Publish via the official pypa/gh-action-pypi-publish using PyPI
  trusted publishing (OIDC), so no API token secret is needed. This
  requires a pending publisher configured on PyPI for this repo with
  environment name "pypi" before the next tag push.
- Pin all actions to current majors (checkout@v7, setup-python@v7,
  upload-artifact@v7, download-artifact@v8), in both workflows.
- Check out with fetch-depth: 0 and tags. Tag-push builds already
  resolved the right version without this, since checkout fetches the
  tag when the ref is a tag, but it removes setuptools_scm's shallow
  repo warning and covers non-exact-tag builds.
- Bump build-system requires to setuptools>=77, which is the floor for
  the PEP 639 `license = "GPL-3.0-or-later"` SPDX expression already in
  use here, and drop `wheel`, which setuptools.build_meta has supplied
  itself since setuptools 70.

Verified locally: `python -m build` produces sdist and wheel with
Metadata-Version 2.4, License-Expression GPL-3.0-or-later and
License-File LICENCE.txt, and both pass `twine check --strict`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUoEZ87BwTncLY5KisT6RQ
Assets 2
Loading