v1.4.0 — PushStream #9
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: publish | |
| # Publishes to PyPI when a GitHub Release is published. | |
| # | |
| # Uses PyPI Trusted Publishing (OIDC) — there is no API token stored anywhere | |
| # in this repository or its secrets. PyPI verifies the workflow's identity | |
| # directly, which means a leaked repo secret cannot be used to publish, because | |
| # there isn't one. | |
| # | |
| # One-time setup on PyPI (Manage project -> Publishing -> Add a pending publisher): | |
| # Owner: livetennisapi | |
| # Repository: livetennisapi-python | |
| # Workflow name: publish.yml | |
| # Environment: pypi | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| name: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3.12' | |
| - run: pip install -e ".[dev]" build twine | |
| - name: Test before publishing | |
| run: pytest -q -m "not contract" | |
| - name: Assert the tag matches the package version | |
| if: github.event_name == 'release' | |
| run: | | |
| TAG="${GITHUB_REF_NAME#v}" | |
| PKG="$(python -c 'import tomllib;print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')" | |
| if [ "$TAG" != "$PKG" ]; then | |
| echo "::error::release tag ($TAG) does not match pyproject version ($PKG)" | |
| exit 1 | |
| fi | |
| echo "tag and version agree: $PKG" | |
| - run: python -m build | |
| - run: twine check dist/* | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: dist | |
| path: dist/ | |
| publish: | |
| name: publish to PyPI | |
| needs: build | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: pypi | |
| url: https://pypi.org/p/livetennisapi | |
| permissions: | |
| id-token: write # required for trusted publishing | |
| steps: | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: dist | |
| path: dist/ | |
| - uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| attestations: true |