|
| 1 | +name: release |
| 2 | + |
| 3 | +# Automated releases via release-please. On every push to master, release-please |
| 4 | +# maintains a "release PR" that bumps the version (pyproject.toml + __init__.py) and |
| 5 | +# the CHANGELOG. Merging that PR creates the vX.Y.Z tag + GitHub Release, then this |
| 6 | +# same run publishes to PyPI (OIDC) and force-moves the sliding v0 major tag. |
| 7 | +# |
| 8 | +# Why publish here instead of relying on publish.yml's tag trigger: release-please |
| 9 | +# creates the tag via the GitHub API using GITHUB_TOKEN, and a GITHUB_TOKEN-created |
| 10 | +# tag does NOT trigger other workflows. So the publish + major-tag steps run as |
| 11 | +# release_created-gated jobs in this workflow. publish.yml / move-major-tag.yml stay |
| 12 | +# as the manual-tag fallback (a human can still `git tag vX.Y.Z && git push`). |
| 13 | + |
| 14 | +on: |
| 15 | + push: |
| 16 | + branches: [master] |
| 17 | + workflow_dispatch: |
| 18 | + |
| 19 | +permissions: {} |
| 20 | + |
| 21 | +jobs: |
| 22 | + release-please: |
| 23 | + runs-on: ubuntu-24.04 |
| 24 | + permissions: |
| 25 | + contents: write # create the release commit, tag, and GitHub Release |
| 26 | + pull-requests: write # open/update the release PR |
| 27 | + issues: write # manage the autorelease:* labels |
| 28 | + outputs: |
| 29 | + release_created: ${{ steps.release.outputs.release_created }} |
| 30 | + tag_name: ${{ steps.release.outputs.tag_name }} |
| 31 | + steps: |
| 32 | + - uses: googleapis/release-please-action@v5 |
| 33 | + id: release |
| 34 | + with: |
| 35 | + token: ${{ secrets.GITHUB_TOKEN }} |
| 36 | + target-branch: master |
| 37 | + config-file: release-please-config.json |
| 38 | + manifest-file: .release-please-manifest.json |
| 39 | + |
| 40 | + publish: |
| 41 | + needs: release-please |
| 42 | + if: ${{ needs.release-please.outputs.release_created == 'true' }} |
| 43 | + runs-on: ubuntu-24.04 |
| 44 | + permissions: |
| 45 | + id-token: write # PyPI OIDC Trusted Publishing |
| 46 | + contents: read |
| 47 | + steps: |
| 48 | + - uses: actions/checkout@v7 |
| 49 | + - uses: astral-sh/setup-uv@v8.2.0 |
| 50 | + - run: uv sync --all-extras |
| 51 | + - name: Verify tag matches package version |
| 52 | + env: |
| 53 | + TAG_NAME: ${{ needs.release-please.outputs.tag_name }} |
| 54 | + run: | |
| 55 | + TAG="${TAG_NAME#v}" |
| 56 | + PKG=$(uv run python -c "import repro_lambda; print(repro_lambda.__version__)") |
| 57 | + if [[ "$TAG" != "$PKG" ]]; then |
| 58 | + echo "tag $TAG != package version $PKG" >&2 |
| 59 | + exit 1 |
| 60 | + fi |
| 61 | + - name: Build sdist + wheel |
| 62 | + run: uv build |
| 63 | + - name: Publish to PyPI |
| 64 | + uses: pypa/gh-action-pypi-publish@release/v1 |
| 65 | + with: |
| 66 | + packages-dir: dist/ |
| 67 | + |
| 68 | + major-tag: |
| 69 | + needs: release-please |
| 70 | + if: ${{ needs.release-please.outputs.release_created == 'true' }} |
| 71 | + runs-on: ubuntu-24.04 |
| 72 | + permissions: |
| 73 | + contents: write |
| 74 | + steps: |
| 75 | + - uses: actions/checkout@v7 |
| 76 | + with: |
| 77 | + fetch-depth: 0 |
| 78 | + fetch-tags: true |
| 79 | + - name: Force-move sliding major tag |
| 80 | + env: |
| 81 | + TAG: ${{ needs.release-please.outputs.tag_name }} |
| 82 | + run: | |
| 83 | + MAJOR="${TAG%%.*}" # v0.4.1 -> v0 |
| 84 | + git tag -f "$MAJOR" "$TAG" |
| 85 | + git push -f origin "refs/tags/$MAJOR" |
0 commit comments