dependabot[bot]
ef5ae933d0
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
75 lines
2.6 KiB
YAML
75 lines
2.6 KiB
YAML
name: Publish to PyPI
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: "3.13"
|
|
- run: pip install build
|
|
- run: python -m build
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: dist
|
|
path: dist/
|
|
|
|
publish:
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
environment: release
|
|
permissions:
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: dist
|
|
path: dist/
|
|
- uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
|
|
|
|
github-release:
|
|
needs: publish
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
id-token: write # keyless Sigstore signing (OIDC); no signing key exists
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: dist
|
|
path: dist/
|
|
- name: Sign artifacts with Sigstore (keyless, OIDC)
|
|
# Produces dist/<artifact>.sigstore.json bundles next to each wheel/sdist.
|
|
# The 'gh release create dist/*' step below then attaches them to the
|
|
# GitHub Release, which is where Scorecard's Signed-Releases check looks.
|
|
# release-signing-artifacts is disabled: the action's own auto-attach only
|
|
# fires on a 'release: published' event, but we trigger on 'push: tags',
|
|
# so we upload the bundles ourselves via the dist/* glob.
|
|
uses: sigstore/gh-action-sigstore-python@5b79a39c381910c090341a2c9b0bf022c8b387e1 # v3.4.0
|
|
with:
|
|
inputs: ./dist/*.tar.gz ./dist/*.whl
|
|
release-signing-artifacts: false
|
|
- name: Extract latest CHANGELOG section
|
|
run: |
|
|
# Grab the topmost "## [...]" block from CHANGELOG.md as release notes.
|
|
awk '/^## \[/{c++} c==1' CHANGELOG.md | sed '/^---$/d' > release_notes.md
|
|
echo "Release notes:" && cat release_notes.md
|
|
- name: Create GitHub Release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
gh release create "${GITHUB_REF_NAME}" \
|
|
--title "${GITHUB_REF_NAME}" \
|
|
--notes-file release_notes.md \
|
|
dist/*
|