dump #28
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Create release | |
| on: | |
| push: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| env: | |
| FORCE_COLOR: "1" | |
| jobs: | |
| publish-pypi: | |
| runs-on: ubuntu-latest | |
| name: PyPI Release | |
| permissions: | |
| id-token: write # for PyPI trusted publishing | |
| attestations: write # for actions/attest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3" | |
| cache: pip | |
| cache-dependency-path: pyproject.toml | |
| - name: Install build dependencies (pypa/build, twine) | |
| run: | | |
| pip install -U pip | |
| pip install build twine | |
| # resolution fails without betterproto and protobuf-specs | |
| pip install "pypi-attestations~=0.0.12" "sigstore-protobuf-specs==0.3.2" "betterproto==2.0.0b6" | |
| - name: Build distribution | |
| run: python -m build | |
| - name: Check distribution | |
| run: | | |
| twine check dist/* | |
| - name: Mint PyPI API token | |
| id: mint-token | |
| uses: actions/github-script@v7 | |
| with: | |
| # language=JavaScript | |
| script: | | |
| // retrieve the ambient OIDC token | |
| const oidc_request_token = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN; | |
| const oidc_request_url = process.env.ACTIONS_ID_TOKEN_REQUEST_URL; | |
| const oidc_resp = await fetch(`${oidc_request_url}&audience=pypi`, { | |
| headers: {Authorization: `bearer ${oidc_request_token}`}, | |
| }); | |
| const oidc_token = (await oidc_resp.json()).value; | |
| // exchange the OIDC token for an API token | |
| const mint_resp = await fetch('https://pypi.org/_/oidc/github/mint-token', { | |
| method: 'post', | |
| body: `{"token": "${oidc_token}"}` , | |
| headers: {'Content-Type': 'application/json'}, | |
| }); | |
| const api_token = (await mint_resp.json()).token; | |
| // mask the newly minted API token, so that we don't accidentally leak it | |
| core.setSecret(api_token) | |
| core.setOutput('api-token', api_token) | |
| - uses: actions/attest@v1 | |
| id: attest | |
| with: | |
| subject-path: "dist/*" | |
| predicate-type: "https://docs.pypi.org/attestations/publish/v1" | |
| predicate: "null" | |
| show-summary: "true" | |
| - run: cat "${{ steps.attest.outputs.bundle-path }}" | |
| - run: jq < "${{ steps.attest.outputs.bundle-path }}" | |
| # - name: Generate PEP 740 attestations | |
| # run: | | |
| # python -m pypi_attestations sign dist/* | |
| # | |
| # - name: Inspect PEP 740 attestations | |
| # run: | | |
| # python -m pypi_attestations inspect dist/*.publish.attestation | |
| # | |
| # - name: Verify PEP 740 attestations | |
| # run: | | |
| # python -m pypi_attestations verify dist/*.whl --identity https://github.com/${{ github.repository }}/.github/workflows/create-release.yml@${{ github.ref }} | |
| # python -m pypi_attestations verify dist/*.tar.gz --identity https://github.com/${{ github.repository }}/.github/workflows/create-release.yml@${{ github.ref }} | |
| # - name: Upload to PyPI | |
| # env: | |
| # TWINE_NON_INTERACTIVE: "true" | |
| # TWINE_USERNAME: "__token__" | |
| # TWINE_PASSWORD: "${{ steps.mint-token.outputs.api-token }}" | |
| # run: | | |
| # twine upload dist/* --attestations | |
| # | |
| # github-release: | |
| # runs-on: ubuntu-latest | |
| # name: GitHub release | |
| # environment: release | |
| # permissions: | |
| # contents: write # for softprops/action-gh-release to create GitHub release | |
| # steps: | |
| # - uses: actions/checkout@v4 | |
| # - name: Get release version | |
| # id: get_version | |
| # uses: actions/github-script@v7 | |
| # with: | |
| # script: core.setOutput('version', context.ref.replace("refs/tags/v", "")) | |
| # | |
| # - name: Create GitHub release | |
| # uses: softprops/action-gh-release@v2 | |
| # if: startsWith(github.ref, 'refs/tags/') | |
| # with: | |
| # name: "Sphinx ${{ steps.get_version.outputs.version }}" | |
| # body: "Changelog: https://www.sphinx-doc.org/en/master/changes.html" |