chore: Upgrade Python requirements (#299) #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| jobs: | |
| run_tests: | |
| uses: ./.github/workflows/python-tests.yml | |
| secrets: inherit | |
| permissions: | |
| contents: read | |
| release: | |
| needs: run_tests | |
| runs-on: ubuntu-latest | |
| if: github.ref_name == 'main' | |
| concurrency: | |
| group: ${{ github.workflow }}-release-${{ github.ref_name }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write | |
| steps: | |
| # Checkout at the branch that triggered the workflow, then force-reset to | |
| # the exact sha so we don't accidentally release commits that arrived | |
| # while this workflow was running. | |
| - name: Setup | Checkout Repository on Release Branch | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.ref_name }} | |
| - name: Setup | Force release branch to workflow sha | |
| run: git reset --hard ${{ github.sha }} | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Set up Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 24 | |
| - name: Install npm dependencies and build | |
| run: | | |
| npm ci | |
| npm run build | |
| - name: Action | Semantic Version Release | |
| id: release | |
| uses: python-semantic-release/python-semantic-release@9a026e9303981c866c3425723009becb2437c757 # v10.6.2 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| git_committer_name: "github-actions" | |
| git_committer_email: "actions@users.noreply.github.com" | |
| changelog: "false" | |
| # Commit, tag, push and build, but don't create the GitHub release. | |
| # We create it ourselves in the next step so that the distributions | |
| # are attached before the release is published. See that step for why. | |
| vcs_release: "false" | |
| # This repo has immutable releases enabled, which freezes a release's | |
| # assets the moment it is published, so assets cannot be attached | |
| # afterwards. `gh release create` handles this by creating the release as | |
| # a draft, uploading the assets, and only then publishing it: | |
| # https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases | |
| - name: Publish | Create GitHub Release with Assets | |
| if: steps.release.outputs.released == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Reuse the release notes python-semantic-release generated for us. | |
| RELEASE_NOTES: ${{ steps.release.outputs.release_notes }} | |
| TAG: ${{ steps.release.outputs.tag }} | |
| run: | | |
| # Output the release notes to a file | |
| printf '%s' "$RELEASE_NOTES" > "$RUNNER_TEMP/release_notes.md" | |
| # Create a draft release, upload the assets, then publish it. | |
| gh release create "$TAG" \ | |
| --verify-tag \ | |
| --title "$TAG" \ | |
| --notes-file "$RUNNER_TEMP/release_notes.md" \ | |
| dist/* | |
| - name: Upload | Distribution Artifacts | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| if: steps.release.outputs.released == 'true' | |
| with: | |
| name: distribution-artifacts | |
| path: dist/ | |
| if-no-files-found: error | |
| outputs: | |
| released: ${{ steps.release.outputs.released || 'false' }} | |
| version: ${{ steps.release.outputs.version }} | |
| publish_to_pypi: | |
| # Separate from the release job for least privilege and retry-ability: | |
| # publishing can fail independently and shouldn't require reversing the release. | |
| runs-on: ubuntu-latest | |
| needs: release | |
| if: github.ref_name == 'main' && needs.release.outputs.released == 'true' | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Download Distribution Artifacts | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 | |
| with: | |
| name: distribution-artifacts | |
| path: dist/ | |
| - name: Publish to PyPI | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| user: __token__ | |
| password: ${{ secrets.PYPI_UPLOAD_TOKEN }} |