Merge pull request #332 from effigies/ci/fork_safe_packaging

CI: Check for secrets before deploying, switch to python-build

Author: effigies

.github/workflows/package.yml

@@ -35,27 +35,34 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Display Python version
         run: python -c "import sys; print(sys.version)"
-      - name: Check python version and upgrade pip
+      - name: Check python version and install build
         run: |
           python --version
-          python -m pip install -U pip setuptools virtualenv twine
+          python -m pip install -U build twine
       - name: Build fitlins
         run: |
-          virtualenv --python=python /tmp/venv/build
-          source /tmp/venv/build/bin/activate
-          pip install --upgrade pip setuptools wheel
-          python setup.py sdist
-          pip wheel --no-deps -w dist/ .
+          python -m build
+      - name: Check distributions
+        run: twine check dist/*
+      - name: Check for PyPI token
+        id: deployable
+        env:
+          TEST_PYPI_API_TOKEN: ${{ secrets.TEST_PYPI_API_TOKEN }}
+          PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        run: |
+          if [ -n "$PYPI_API_TOKEN" ]; then echo ::set-output name=DEPLOY::true; fi
+          if [ -n "$TEST_PYPI_API_TOKEN" ]; then echo ::set-output name=TEST_DEPLOY::true; fi
       - name: Test PyPI upload
-        uses: pypa/gh-action-pypi-publish@master
+        if: steps.deployable.outputs.TEST_DEPLOY
+        uses: pypa/gh-action-pypi-publish@release/v1
         with:
           user: __token__
           password: ${{ secrets.TEST_PYPI_API_TOKEN }}
           repository_url: https://test.pypi.org/legacy/
           skip_existing: true
       - name: Upload to PyPI (on tags)
-        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@master
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') && steps.deployable.outputs.DEPLOY
+        uses: pypa/gh-action-pypi-publish@release/v1
         with:
           user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}