57 lines
1.8 KiB
YAML
57 lines
1.8 KiB
YAML
# Publishes to PyPI via Trusted Publishing (OIDC) — no stored token.
|
|
# Fires on a version tag (vX.Y.Z, plus PEP 440 pre-releases vX.Y.ZrcN / aN / bN).
|
|
# The `release` environment gates the upload behind manual approval; configure
|
|
# required reviewers under Settings → Environments → release.
|
|
#
|
|
# One-time setup on PyPI (project owner, cannot be done from CI):
|
|
# PyPI → project `everos` → Settings → Publishing → add a GitHub trusted
|
|
# publisher: owner=EverMind-AI, repo=EverOS, workflow=release.yml,
|
|
# environment=release.
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
# vX.Y.Z plus PEP 440 pre-release/dev suffixes (rc1 / a1 / b1 / .dev1).
|
|
- "v[0-9]+.[0-9]+.[0-9]+*"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
publish:
|
|
name: build + publish to PyPI
|
|
runs-on: ubuntu-latest
|
|
environment: release
|
|
permissions:
|
|
id-token: write # OIDC token for PyPI Trusted Publishing
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v8.2.0
|
|
with:
|
|
enable-cache: true
|
|
cache-dependency-glob: uv.lock
|
|
|
|
- name: Set up Python
|
|
run: uv python install 3.12
|
|
|
|
# Guard: the tag must match the package version, so a mistyped tag can't
|
|
# publish the wrong release.
|
|
- name: Verify tag matches pyproject version
|
|
run: |
|
|
tag="${GITHUB_REF_NAME#v}"
|
|
pkg="$(grep -m1 -E '^version = ' pyproject.toml | sed -E 's/^version = "(.+)"/\1/')"
|
|
if [ "$tag" != "$pkg" ]; then
|
|
echo "::error::tag v$tag != pyproject version $pkg"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Build + smoke-test the package
|
|
run: make package # builds sdist+wheel into dist/ and import-smokes it
|
|
|
|
- name: Publish to PyPI (Trusted Publishing)
|
|
uses: pypa/gh-action-pypi-publish@release/v1
|