Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CI: Separate jobs for publishing to TestPyPI and PyPI #3742

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
+49 −9
Open

CI: Separate jobs for publishing to TestPyPI and PyPI #3742

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ffd2ee0
CI: Separate jobs for publishing to TestPyPI and PyPI
weiji14 Jan 3, 2025
190d93e
Apply suggestions from code review
weiji14 Jan 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 49 additions & 9 deletions .github/workflows/publish-to-pypi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,20 +35,17 @@ on:
# - main

jobs:
publish-pypi:
name: Publish to PyPI
build:
name: Build distribution 📦
runs-on: ubuntu-latest
permissions:
# This permission is mandatory for OIDC publishing
id-token: write
if: github.repository == 'GenericMappingTools/pygmt'

steps:
- name: Checkout
uses: actions/[email protected]
with:
# fetch all history so that setuptools-scm works
fetch-depth: 0
persist-credentials: false
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any specific reason to add the persist-credentials: false line?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was from the template at https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#checking-out-the-project-and-building-distributions, so I just added it in. The default is persist-credentials: true according to https://github.com/actions/checkout/tree/v4.2.2?tab=readme-ov-file#checkout-v4, which would mean the credentials do not persist between jobs (e.g. from the build job to the publish-to-testpypi and publish-pypi jobs and is supposed to be less secure if I'm reading actions/checkout#485 correctly. Setting to persist-credentials: false should be more secure, though unsure if it really matters.


- name: Set up Python
uses: actions/[email protected]
Expand All @@ -74,11 +71,54 @@ jobs:
echo "Generated files:"
ls -lh dist/

- name: Publish to Test PyPI
- name: Store the distribution packages
uses: actions/upload-artifact@v4
weiji14 marked this conversation as resolved.
Show resolved Hide resolved
with:
name: python-package-distributions
path: dist/

publish-to-testpypi:
name: Publish Python 🐍 distribution 📦 to TestPyPI
if: github.repository == 'GenericMappingTools/pygmt'
needs:
- build
runs-on: ubuntu-latest
environment:
name: testpypi
url: https://test.pypi.org/p/pygmt
weiji14 marked this conversation as resolved.
Show resolved Hide resolved
permissions:
id-token: write # IMPORTANT: mandatory for trusted OIDC publishing

steps:
- name: Download all the dists
uses: actions/download-artifact@v4
weiji14 marked this conversation as resolved.
Show resolved Hide resolved
with:
name: python-package-distributions
path: dist/

- name: Publish distribution 📦 to TestPyPI
uses: pypa/[email protected]
with:
repository-url: https://test.pypi.org/legacy/

- name: Publish to PyPI
if: startsWith(github.ref, 'refs/tags')
publish-pypi:
name: Publish Python 🐍 distribution 📦 to PyPI
if: github.repository == 'GenericMappingTools/pygmt' && startsWith(github.ref, 'refs/tags/')
needs:
- build
runs-on: ubuntu-latest
environment:
name: pypi
url: https://pypi.org/p/pygmt
weiji14 marked this conversation as resolved.
Show resolved Hide resolved
permissions:
id-token: write # IMPORTANT: mandatory for trusted OIDC publishing

steps:
- name: Download all the dists
uses: actions/download-artifact@v4
weiji14 marked this conversation as resolved.
Show resolved Hide resolved
with:
name: python-package-distributions
path: dist/

- name: Publish distribution 📦 to PyPI
uses: pypa/[email protected]
Loading