spectralbrain/.github/workflows/python-publish.yml at main · rdneuro/spectralbrain · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
name: Publish to PyPI

on:
  release:
    types: [published]

  # Allow manual trigger from the Actions tab (useful for testing)
  workflow_dispatch:

jobs:
  # ─────────────────────────────────────────────────────────────────────
  #  Job 1: Build the distribution (sdist + wheel)
  # ─────────────────────────────────────────────────────────────────────
  build:
    name: Build distribution 📦
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install build tools
        run: |
          python -m pip install --upgrade pip
          python -m pip install build

      - name: Build sdist and wheel
        run: python -m build

      # Verify the built distributions are valid
      - name: Check distributions
        run: |
          python -m pip install twine
          twine check dist/*

      # Upload the built artifacts so the publish jobs can download them
      - name: Upload distributions
        uses: actions/upload-artifact@v4
        with:
          name: python-package-distributions
          path: dist/

  # ─────────────────────────────────────────────────────────────────────
  #  Job 2: Publish to PyPI (production)
  # ─────────────────────────────────────────────────────────────────────
  publish-pypi:
    name: Publish to PyPI 🚀
    needs: build
    runs-on: ubuntu-latest

    # This environment MUST match the one you configured on PyPI
    # (step 3 in the setup instructions above)
    environment:
      name: pypi
      url: https://pypi.org/p/spectralbrain

    # These permissions are required for Trusted Publishers (OIDC)
    permissions:
      id-token: write   # Needed to mint the OIDC token
      contents: read     # Needed to read the repo

    steps:
      - name: Download distributions
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions
          path: dist/

      # This action handles the OIDC exchange with PyPI automatically.
      # No API token or password is needed — PyPI verifies the GitHub
      # repository, workflow, and environment via the OIDC identity token.
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  # ─────────────────────────────────────────────────────────────────────
  #  Job 3 (optional): Publish to TestPyPI first
  # ─────────────────────────────────────────────────────────────────────
  #  Uncomment this job if you want to test on TestPyPI before going
  #  to production. You'll also need to configure a "testpypi"
  #  environment on TestPyPI (see setup instructions above).
  #
  # publish-testpypi:
  #   name: Publish to TestPyPI 🧪
  #   needs: build
  #   runs-on: ubuntu-latest
  #
  #   environment:
  #     name: testpypi
  #     url: https://test.pypi.org/p/spectralbrain
  #
  #   permissions:
  #     id-token: write
  #     contents: read
  #
  #   steps:
  #     - name: Download distributions
  #       uses: actions/download-artifact@v4
  #       with:
  #         name: python-package-distributions
  #         path: dist/
  #
  #     - name: Publish to TestPyPI
  #       uses: pypa/gh-action-pypi-publish@release/v1
  #       with:
  #         repository-url: https://test.pypi.org/legacy/

  # ─────────────────────────────────────────────────────────────────────
  #  Job 4: Create GitHub Release assets
  # ─────────────────────────────────────────────────────────────────────
  #  Attaches the built .whl and .tar.gz files to the GitHub Release
  #  so users can also download them directly from the release page.
  github-release:
    name: Attach to GitHub Release 📎
    needs: publish-pypi
    runs-on: ubuntu-latest

    permissions:
      contents: write   # Needed to upload release assets
      id-token: write

    steps:
      - name: Download distributions
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions
          path: dist/

      - name: Sign with Sigstore
        uses: sigstore/gh-action-sigstore-python@v3.0.0
        with:
          inputs: >-
            ./dist/*.tar.gz
            ./dist/*.whl

      - name: Upload to GitHub Release
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          # Upload (and overwrite, if re-running) every built artifact.
          # --clobber replaces same-named assets, so we never need to
          # hard-code version-specific filenames here.
          gh release upload \
            "${{ github.ref_name }}" \
            dist/** \
            --clobber \
            --repo "${{ github.repository }}"