67 lines
2.7 KiB
YAML
67 lines
2.7 KiB
YAML
# Publishes the paperspec Python package to this instance's PyPI registry when a version tag (v0.1.1) is
|
|
# pushed; see deploy/README.md for the secrets it needs and how to install from the registry.
|
|
# The package version comes from the tag through setuptools-scm, so the job refuses to upload unless the
|
|
# built version equals the tag. Run it by hand only on a tag, for example after adding the secrets.
|
|
name: publish
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
workflow_dispatch:
|
|
permissions:
|
|
contents: read
|
|
concurrency:
|
|
group: publish-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
jobs:
|
|
publish:
|
|
runs-on: linux-base
|
|
container:
|
|
image: git.scient.ing/infra/linux-base:26.10.7
|
|
timeout-minutes: 30
|
|
env:
|
|
REGISTRY: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/pypi
|
|
steps:
|
|
- name: Require a version tag
|
|
run: |
|
|
if [[ "$GITHUB_REF" != refs/tags/v* ]]; then
|
|
echo "Publish runs on a version tag such as v0.1.1; $GITHUB_REF is not one."
|
|
exit 1
|
|
fi
|
|
# The whole history, so setuptools-scm finds the tag and computes the release version.
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
- name: Check the repository
|
|
run: pixi run --locked check
|
|
- name: Build the sdist and wheel
|
|
run: pixi run --locked -e dev dist
|
|
- name: Confirm the built version is the tag
|
|
run: |
|
|
tag="${GITHUB_REF_NAME#v}"
|
|
wheels=(dist/paperspec-*.whl)
|
|
built="$(basename "${wheels[0]}" | cut -d- -f2)"
|
|
echo "tag $GITHUB_REF_NAME, built $built"
|
|
if [ "${#wheels[@]}" -ne 1 ] || [ "$built" != "$tag" ]; then
|
|
echo "The built version is not the tag's; is the tag on the commit this job checked out?"
|
|
exit 1
|
|
fi
|
|
- name: Check the package metadata
|
|
run: pixi run --locked -e dev twine check --strict dist/*
|
|
# --skip-existing makes a rerun on the same tag succeed instead of failing on the files already there.
|
|
- name: Upload to the package registry
|
|
env:
|
|
TWINE_USERNAME: ${{ secrets.PACKAGE_USER }}
|
|
TWINE_PASSWORD: ${{ secrets.PACKAGE_TOKEN }}
|
|
TWINE_REPOSITORY_URL: ${{ env.REGISTRY }}
|
|
run: |
|
|
if [ -z "$TWINE_USERNAME" ] || [ -z "$TWINE_PASSWORD" ]; then
|
|
echo "The secrets PACKAGE_USER and PACKAGE_TOKEN are not set; deploy/README.md says how."
|
|
exit 1
|
|
fi
|
|
pixi run --locked -e dev twine upload --non-interactive --skip-existing dist/*
|
|
echo "Published to $REGISTRY: pip install --index-url $REGISTRY/simple/ paperspec"
|