Merge pull request #42 from thombashi/add_publish_pkg_ci

Update the CI workflow to include a job that publishes packages to TestPyPI

.github/workflows/ci.yml

@@ -10,21 +10,78 @@ on:
       - ".gitignore"
       - "README.rst"
 
+permissions:
+  contents: read
+
 jobs:
   build-package:
     runs-on: ubuntu-latest
     concurrency:
       group: ${{ github.event_name }}-${{ github.workflow }}-${{ github.ref_name }}-build
       cancel-in-progress: true
     timeout-minutes: 20
-    container:
-      image: ghcr.io/thombashi/python-ci:3.11
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: |
+            setup.py
+            **/*requirements.txt
+            tox.ini
+
+      - run: make setup-ci
 
       - run: make build
 
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: ./dist/*
+
+  publish-package:
+    needs: build-package
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.event_name }}-${{ github.workflow }}-${{ github.ref_name }}-publish-pkg
+      cancel-in-progress: true
+    timeout-minutes: 20
+    environment:
+      name: testpypi
+      url: https://pypi.org/p/pathvalidate
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: ./dist
+
+      - name: Publish package to TestPyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+      - name: Sign the dists with Sigstore
+        uses: sigstore/gh-action-sigstore-python@v2.1.1
+        with:
+          inputs: >-
+            ./dist/*.tar.gz
+            ./dist/*.whl
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sigstore
+          path: ./dist/*
+
   lint:
     runs-on: ubuntu-latest
     concurrency:
@@ -139,7 +196,6 @@ jobs:
       - uses: GitHubSecurityLab/actions-permissions/monitor@v1
         with:
           config: ${{ vars.PERMISSIONS_CONFIG }}
-        if: ${{ matrix.os == 'ubuntu-latest' }}
 
       - uses: actions/checkout@v4
 

pyproject.toml

@@ -1,6 +1,14 @@
 [build-system]
 build-backend = "setuptools.build_meta"
-requires = ["setuptools>=61.0"]
+requires = [
+  "setuptools>=64",
+  "setuptools_scm>=7,<8; python_version<'3.8'",
+  "setuptools_scm>=8; python_version>='3.8'",
+]
+
+[tool.setuptools_scm]
+version_scheme = "guess-next-dev"
+local_scheme = "no-local-version"
 
 [tool.black]
 exclude = '''

setup.py

@@ -6,6 +6,7 @@
 from typing import Dict, Type
 
 import setuptools
+from setuptools_scm import ScmVersion
 
 
 MODULE_NAME = "pathvalidate"
@@ -16,6 +17,24 @@
 pkg_info: Dict[str, str] = {}
 
 
+def version_scheme(version: ScmVersion) -> str:
+    from packaging.version import parse
+    from setuptools_scm import get_version
+    from setuptools_scm.version import guess_next_version
+
+    scm_version = get_version()
+    parsed_version = parse(scm_version)
+
+    if parsed_version.is_devrelease:
+        return version.format_next_version(guess_next_version, "{guessed}.dev{distance}")
+
+    return version.format_with("{tag}")
+
+
+def no_local_version(version: ScmVersion) -> str:
+    return ""
+
+
 def get_release_command_class() -> Dict[str, Type[setuptools.Command]]:
     try:
         from releasecmd import ReleaseCommand
@@ -42,7 +61,6 @@ def get_release_command_class() -> Dict[str, Type[setuptools.Command]]:
 
 setuptools.setup(
     name=MODULE_NAME,
-    version=pkg_info["__version__"],
     url=REPOSITORY_URL,
     author=pkg_info["__author__"],
     author_email=pkg_info["__email__"],

tox.ini

@@ -21,7 +21,7 @@ commands =
 
 [testenv:build]
 deps =
-    build>=0.10
+    build>=1
     twine
     wheel
 commands =