datamaker-py/.github/workflows/python-publish.yml at main · automators-com/datamaker-py · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
# On a published GitHub release: build the package, publish it to PyPI (via
# trusted publishing), and also attach the wheel + sdist to the GitHub release.
#
# PyPI is the source of truth consumers resolve from (`datamaker-py>=x.y`), which
# is what lets the DataMaker desktop runner install it offline from its bundled
# wheelhouse - a registry/name-versioned dep is satisfiable from --find-links,
# whereas a direct-URL pin is not. The GitHub release assets are kept as a
# convenient, no-auth fallback URL.
#
# ONE-TIME SETUP (PyPI side, required before the first publish succeeds):
#   On pypi.org → Account → Publishing → add a "pending publisher":
#     PyPI Project Name: datamaker-py
#     Owner:             automators-com
#     Repository:        datamaker-py
#     Workflow name:     python-publish.yml
#     Environment:       pypi
#   The first successful run then creates the project. No API token/secret is
#   stored - auth is OIDC via the `id-token: write` permission below.

name: Upload Python Package

on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  release-build:
    runs-on: ubuntu-latest

    # Needed so we can attach the built wheel + sdist to the GitHub release.
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v3

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      # The tagged commit is what consumers pin to, and tags are immutable - a
      # stale artifact here ships a version stamp that disagrees with the release
      # and can never be corrected in place. Fail before anything is published.
      - name: Verify committed autocomplete artifact matches this release
        run: |
          python scripts/generate-autocomplete-artifact.py \
            --output-path ./artifacts/autocomplete-types.ts --check

      - name: Build release distributions
        run: |
          uv build

      - name: Upload distributions
        uses: actions/upload-artifact@v4
        with:
          name: release-dists
          path: dist/

      # Attach the wheel (and sdist) to the GitHub release as a no-auth fallback.
      - name: Attach distributions to the GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${{ github.event.release.tag_name }}" dist/*.whl dist/*.tar.gz --clobber

  pypi-publish:
    runs-on: ubuntu-latest
    needs:
      - release-build
    permissions:
      # Mandatory for PyPI trusted publishing (OIDC) - no API token needed.
      id-token: write
    environment:
      name: pypi
      url: https://pypi.org/p/datamaker-py

    steps:
      - name: Retrieve release distributions
        uses: actions/download-artifact@v4
        with:
          name: release-dists
          path: dist/

      - name: Publish release distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/