Merge pull request #8 from senderkit/dependabot/github_actions/github… #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Automated releases via release-please + PyPI Trusted Publishing. | |
| # | |
| # Flow: | |
| # 1. Pushes to main run release-please, which maintains a "release PR" that | |
| # bumps the version (src/senderkit/_version.py) and CHANGELOG.md from the | |
| # Conventional Commit history. | |
| # 2. Merging that release PR tags the version + creates the GitHub Release and, | |
| # in the same run, builds and publishes to PyPI. | |
| # | |
| # Everything stays in ONE workflow run so it does not depend on the GitHub | |
| # Release event (events raised by GITHUB_TOKEN do not trigger other workflows). | |
| # | |
| # One-time repo setup: | |
| # - Settings → Actions → General → Workflow permissions: | |
| # enable "Allow GitHub Actions to create and approve pull requests". | |
| # - A PyPI Trusted Publisher for this repo → workflow "release.yml" → | |
| # environment "pypi". https://docs.pypi.org/trusted-publishers/ | |
| on: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| release-please: | |
| name: Release please | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # create tags + GitHub releases | |
| pull-requests: write # open/update the release PR | |
| outputs: | |
| release_created: ${{ steps.release.outputs.release_created }} | |
| tag_name: ${{ steps.release.outputs.tag_name }} | |
| steps: | |
| - uses: googleapis/release-please-action@v5 | |
| id: release | |
| with: | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| build: | |
| name: Build distributions | |
| needs: release-please | |
| if: needs.release-please.outputs.release_created == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install build tooling | |
| run: python -m pip install build twine | |
| - name: Build sdist and wheel | |
| run: python -m build | |
| - name: Check metadata | |
| run: twine check dist/* | |
| - name: Verify built version matches the release tag | |
| env: | |
| TAG: ${{ needs.release-please.outputs.tag_name }} | |
| run: | | |
| # Install the freshly built wheel so we verify the artifact that is | |
| # about to be published, not an editable/source checkout. | |
| python -m pip install dist/*.whl | |
| VERSION="$(python -c 'import senderkit; print(senderkit.__version__)')" | |
| echo "Package version: $VERSION" | |
| echo "Release tag: $TAG" | |
| if [ "${TAG#v}" != "$VERSION" ]; then | |
| echo "::error::Release tag ($TAG) does not match package version ($VERSION)." | |
| exit 1 | |
| fi | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: dist | |
| path: dist/ | |
| publish: | |
| name: Publish to PyPI | |
| needs: [release-please, build] | |
| if: needs.release-please.outputs.release_created == 'true' | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: pypi | |
| url: https://pypi.org/p/senderkit | |
| permissions: | |
| contents: read | |
| id-token: write # required for Trusted Publishing | |
| steps: | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: dist | |
| path: dist/ | |
| - name: Publish | |
| uses: pypa/gh-action-pypi-publish@release/v1 |