publish-python.yaml

# This workflow will upload a Python Package using Twine when a release is created
# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: Upload Python Package

on:
  release:
    types: [published]

permissions:
  contents: write
  id-token: write

jobs:
  deploy:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3
    - name: Set up Python
      uses: actions/setup-python@v3
      with:
        python-version: '3.x'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build
    - name: Build package
      run: python -m build
    - name: List artifacts
      run: ls ./dist
    - name: Install sigstore
      run: python -m pip install sigstore
    - name: Signing
      run: |
        for dist in dist/*; do
          dist_base="$(basename "${dist}")"
          echo "dist: ${dist}"
          echo "dist_base: ${dist_base}"
          python -m \
            sigstore sign "${dist}" \
            --output-signature "${dist_base}.sig" \
            --output-certificate "${dist_base}.crt" \
            --bundle "${dist_base}.sigstore"

          # Verify using `.sig` `.crt` pair;
          python -m \
            sigstore verify identity "${dist}" \
            --signature "${dist_base}.sig" \
            --cert "${dist_base}.crt" \
            --cert-oidc-issuer https://token.actions.githubusercontent.com \
            --cert-identity ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/.github/workflows/publish-python.yaml@${GITHUB_REF}

          # Verify using `.sigstore` bundle;
          python -m \
            sigstore verify identity "${dist}" \
            --bundle "${dist_base}.sigstore" \
            --cert-oidc-issuer https://token.actions.githubusercontent.com \
            --cert-identity ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/.github/workflows/publish-python.yaml@${GITHUB_REF}
          done
    - name: List artifacts after sign
      run: ls ./dist
    - name: Copy files to release
      run: |
        gh release upload ${{ github.event.release.tag_name }} *.sigstore
        gh release upload ${{ github.event.release.tag_name }} *.sig
        gh release upload ${{ github.event.release.tag_name }} *.crt
      env:
        GITHUB_TOKEN: ${{ github.TOKEN }}
    - name: Publish package
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        user: __token__
        password: ${{ secrets.PYPI_API_TOKEN }}