Structorium/.github/workflows/python-publish.yml at main · DivyamTalwar/Structorium · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
name: Publish

on:
  release:
    types:
      - published
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      publish:
        description: "Allow publishing outside release/tag events"
        required: false
        default: false
        type: boolean

permissions:
  contents: read
  id-token: write
  attestations: write

concurrency:
  group: publish-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

defaults:
  run:
    shell: bash

env:
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  PYTHONDONTWRITEBYTECODE: "1"
  PYTHONUNBUFFERED: "1"

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment:
      name: pypi
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions/setup-python@v6
        with:
          python-version: '3.12'
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Validate tag matches package version
        run: |
          python - <<'PY'
          import os
          import re
          import tomllib
          from pathlib import Path
          ref = os.environ.get('GITHUB_REF', '')
          if ref.startswith('refs/tags/'):
              tag = ref.rsplit('/', 1)[-1]
              version = tomllib.loads(Path('pyproject.toml').read_text())['project']['version']
              if tag != f'v{version}':
                  raise SystemExit(f'tag {tag} does not match package version v{version}')
          PY

      - name: Check if version exists on PyPI
        run: |
          python - <<'PY'
          import json
          import urllib.error
          import urllib.request
          import tomllib
          from pathlib import Path
          package_name = "structorium"
          version = tomllib.loads(Path('pyproject.toml').read_text())['project']['version']
          url = f"https://pypi.org/pypi/{package_name}/json"
          try:
              with urllib.request.urlopen(url, timeout=10) as resp:
                  payload = json.load(resp)
          except urllib.error.HTTPError as exc:
              if exc.code == 404:
                  print(f"{package_name} not found on PyPI yet, allowing publish of v{version}")
              else:
                  raise
          else:
              releases = payload.get("releases", {})
              if version in releases:
                  raise SystemExit(
                      f"Version {package_name}=={version} already exists on PyPI; "
                      "bump version before publishing."
                  )
              print(f"Version {package_name}=={version} is available for publish.")
          PY

      - name: Run packaging smoke gate
        run: make package-smoke

      - name: Build distributions
        run: python -m build

      - name: Attest artifacts
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: dist/*

      - name: Publish to PyPI
        if: >
          startsWith(github.ref, 'refs/tags/v') ||
          github.event_name == 'release' ||
          (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true')
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          print-hash: true