37b9dbdbf4
Following recent discussions, this changes the development process as follows: 1. The deploy is now manually triggered after the release PR is approved. 2. The deploy workflow tags the repository only after the package has been published to PyPI. 3. Use PyPI trusted publishers instead of API tokens. Co-authored-by: Ran Benita <ran@unusedvar.com>
48 lines
1.1 KiB
YAML
48 lines
1.1 KiB
YAML
name: deploy
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'Release version'
|
|
required: true
|
|
default: '1.2.3'
|
|
|
|
jobs:
|
|
|
|
package:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
SETUPTOOLS_SCM_PRETEND_VERSION: ${{ github.event.inputs.version }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Build and Check Package
|
|
uses: hynek/build-and-inspect-python-package@v1.5
|
|
|
|
deploy:
|
|
needs: package
|
|
runs-on: ubuntu-latest
|
|
environment: deploy
|
|
permissions:
|
|
id-token: write # For PyPI trusted publishers.
|
|
contents: write # For tag.
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Download Package
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: Packages
|
|
path: dist
|
|
|
|
- name: Publish package to PyPI
|
|
uses: pypa/gh-action-pypi-publish@v1.8.5
|
|
|
|
- name: Push tag
|
|
run: |
|
|
git tag --annotate --message=v${{ github.event.inputs.version }} v${{ github.event.inputs.version }} ${{ github.sha }}
|
|
git push origin v${{ github.event.inputs.version }}
|