Repository navigation
ci: publish to PyPI from a GitHub release (trusted publishing) - #65
Merged
Merged
Conversation
Adds .github/workflows/publish.yml: on a published GitHub Release, build sdist+wheel from the release tag, check metadata with twine, and publish to PyPI via pypa/gh-action-pypi-publish using OIDC trusted publishing (permissions: id-token: write) -- no stored token/secret. Scoped to a "pypi" GitHub Environment so PyPI's trusted-publisher check is exact (repo + workflow + environment) and so manual-approval gating can be added later if wanted. Requires a one-time manual step on PyPI: add a trusted publisher on the existing pgraph-python project (Settings -> Publishing) naming this repo, workflow filename, and the "pypi" environment. Also adds workflow_dispatch to ci.yml's triggers, and widens the docs job's condition to run on manual dispatch as well as push, so the Sphinx docs can be manually rebuilt/redeployed on demand without any relationship to a PyPI release -- the two are on separate triggers entirely (push+dispatch for docs, release-published only for PyPI). Verified: pyproject.toml/publish.yml YAML parses; `python -m build` produces a clean sdist+wheel from this checkout; `twine check` passes on both; a genuinely isolated venv (confirmed via sys.prefix) installs the built wheel and successfully imports and exercises real functionality (UGraph/add_vertex/add_edge/__str__). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
make pypi (build + twine upload + tag + push) is superseded by .github/workflows/publish.yml's trusted-publish-on-release flow. Updated the help text accordingly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
publish.yml follows the release workflow of the other toolboxes: verify that the tag is the version in pyproject.toml and that the tagged commit is on main, build the sdist and wheel, twine check, install the wheel into a clean environment and run a path query, then upload with OIDC from the pypi environment. skip_existing makes a re-run harmless. The default token is read-only. The docs job of ci.yml can be run by hand, from main only. The manual twine-upload Makefile target is gone, as a release does it. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Up to standards ✅🟢 Issues
|
A third-party action with the right to publish should be an immutable reference. dependabot (github-actions, monthly) keeps it current. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #65 +/- ##
=======================================
Coverage 97.26% 97.26%
=======================================
Files 3 3
Lines 1570 1570
=======================================
Hits 1527 1527
Misses 43 43 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
.github/workflows/publish.yml, which is not onmainyet, so a GitHub release would not currently publish anything. It follows the release workflow of the other toolboxes (MVTB, bdsim): OIDC trusted publishing, no stored token.What it does, on
release: createdorworkflow_dispatchv1.0.0) must equal[project].versioninpyproject.toml, and the tagged commit must be onmain. The 0.6.5 release was tagged on a commit that was never merged, so main still says 0.6.4; this refuses that.python -m build, thentwine check.pypa/gh-action-pypi-publishfrom thepypienvironment, withid-token: writeon this job only;skip_existingmakes a re-run harmless.The workflow token is
contents: readeverywhere else (the repository default is write).Also
ci.yml: the docs job can be run by hand withworkflow_dispatch, frommainonly, so unreviewed docs cannot be deployed togh-pages.Makefile: the manualmake pypitarget (build,twine upload, tag, push) is removed; a release does it.Rehearsed here
From a clean checkout:
python -m buildgives the sdist and wheel,twine checkpasses, the wheel installs into a fresh venv (checked that it is isolated) and the smoke test printsOK 0.6.4 5.0. The version guard passes for a matching tag and refuses a mismatch. (This is not a release: main is still 0.6.4, so a tagv1.0.0is refused until #14 is merged, which is the intent.)Needed on PyPI before it can upload (not in this PR)
A trusted publisher for
pgraph-python: ownerpetercorke, repositorypgraph-python, workflowpublish.yml, environmentpypi. (The entry there now sayspipit.) GitHub will create thepypienvironment on the first run; add a required reviewer if you want an approval gate.Release order
Merge this, then update and merge #14 (version 1.0.0), then create the GitHub release from
main.🤖 Generated with Claude Code