sdk/.github/workflows/python.yml at main · tesote/sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
name: python

on:
  push:
    branches: [main]
    paths:
      - 'packages/python/**'
      - 'spec/**'
      - '.github/workflows/python.yml'
  pull_request:
    branches: [main]
    paths:
      - 'packages/python/**'
      - 'spec/**'
      - '.github/workflows/python.yml'

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

permissions:
  contents: read

defaults:
  run:
    working-directory: packages/python

jobs:
  test:
    runs-on: blacksmith-2vcpu-ubuntu-2204
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.9', '3.13']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: install package + dev tooling
        run: |
          python -m pip install --upgrade pip
          pip install -e .[test]
      - name: ruff
        run: ruff check .
      - name: mypy
        run: mypy src
      - name: pytest
        run: pytest

  release:
    needs: test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: blacksmith-2vcpu-ubuntu-2204
    permissions:
      id-token: write
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.13'
      - name: gate on version
        id: gate
        run: |
          set -euo pipefail
          version="$(python -c "import tomllib, pathlib; print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")"
          tag="python-v$version"
          release=true
          if git -C "$GITHUB_WORKSPACE" ls-remote --exit-code --tags origin "refs/tags/$tag" >/dev/null 2>&1; then
            echo "tag $tag already exists; skipping release."
            release=false
          elif grep -qE "^## ${version} - unreleased" CHANGELOG.md; then
            echo "CHANGELOG marks ${version} as unreleased; skipping publish."
            release=false
          fi
          echo "release=$release" >> "$GITHUB_OUTPUT"
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
      - if: steps.gate.outputs.release == 'true'
        name: install build
        run: |
          python -m pip install --upgrade pip
          pip install build
      - if: steps.gate.outputs.release == 'true'
        name: build sdist + wheel
        run: python -m build
      - if: steps.gate.outputs.release == 'true'
        name: publish to PyPI (OIDC trusted publisher)
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: packages/python/dist
      - if: steps.gate.outputs.release == 'true'
        name: tag and GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        working-directory: ${{ github.workspace }}
        run: |
          tag="${{ steps.gate.outputs.tag }}"
          git tag "$tag"
          git push origin "$tag"
          gh release create "$tag" \
            --title "$tag" \
            --generate-notes \
            packages/python/dist/*