md-condition/.github/workflows/pythonpublish.yml at master · cssho/md-condition · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
name: Upload Python Package

on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  # Test and build without OIDC permissions; only the publish job can mint a PyPI token
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        fetch-depth: 0  # setuptools-scm derives the version from tags
        persist-credentials: false
    - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
    - name: Test
      run: |
        uv run ruff check .
        uv run pytest
    - name: Build
      run: uv build
    - name: Check version matches tag
      env:
        TAG: ${{ github.event.release.tag_name }}
      run: |
        # A malformed tag (e.g. vv0.2.0) makes setuptools-scm fall back to a dev version
        ls dist
        test -f "dist/md_condition-${TAG#v}-py3-none-any.whl"
        test -f "dist/md_condition-${TAG#v}.tar.gz"
    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
      with:
        name: dist
        path: dist/

  publish:
    needs: build
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write  # PyPI Trusted Publishing
    steps:
    - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
      with:
        name: dist
        path: dist/
    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3