-
Notifications
You must be signed in to change notification settings - Fork 6
Rename package from workato_platform to workato_platform_cli #24
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Changes from all commits
Commits
Show all changes
14 commits
Select commit
Hold shift + click to select a range
095a106
pypi workflow
cmworkato 99ffd3c
Rename workato_platform to workato_platform_cli for consistency
cmworkato 7c0657e
Merge branch 'main' into pypi-workflow-setup
cmworkato ff10e90
Update version to PyPI-compatible format with dev suffix
cmworkato 9f8be9f
Fix hatch-vcs configuration and use git tags for versioning
cmworkato ba51321
Install hatch-vcs in CI before version extraction
cmworkato 1105a97
Use git describe for version extraction instead of hatchling
cmworkato f766624
Trigger new deployment with fixed imports
cmworkato 496692b
Trigger test deployment
cmworkato 179d8b4
Fix uv cache dependency glob to use pyproject.toml
cmworkato b6b059b
Remove incorrectly generated API client files and fix cache config
cmworkato 6a51324
Rename package from workato_platform to workato_platform_cli
cmworkato 6069b50
Update test imports for workato_platform_cli package rename
cmworkato c837439
Fix lint errors: line length and import formatting
cmworkato File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,196 @@ | ||
| name: Build and Publish to PyPI | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - test | ||
| - release | ||
| tags: | ||
| - '[0-9]+.[0-9]+.[0-9]+' | ||
| - '[0-9]+.[0-9]+.[0-9]+-*' | ||
| workflow_dispatch: | ||
| inputs: | ||
| environment: | ||
| description: 'Deployment environment' | ||
| required: true | ||
| type: choice | ||
| options: | ||
| - test | ||
| - release | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| version: ${{ steps.version.outputs.version }} | ||
| environment: ${{ steps.determine-env.outputs.environment }} | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # Required for hatch-vcs versioning | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: '3.11' | ||
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@v5 | ||
| with: | ||
| enable-cache: true | ||
| cache-dependency-glob: "pyproject.toml" | ||
|
|
||
| - name: Install build dependencies | ||
| run: | | ||
| uv pip install --system build hatch hatch-vcs twine | ||
|
|
||
| - name: Determine environment | ||
| id: determine-env | ||
| run: | | ||
| if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then | ||
| echo "environment=${{ inputs.environment }}" >> $GITHUB_OUTPUT | ||
| elif [[ "${{ github.ref }}" == "refs/heads/test" ]]; then | ||
| echo "environment=test" >> $GITHUB_OUTPUT | ||
| elif [[ "${{ github.ref }}" == "refs/heads/release" ]] || [[ "${{ github.ref }}" == refs/tags/* ]]; then | ||
| echo "environment=release" >> $GITHUB_OUTPUT | ||
| fi | ||
|
|
||
| - name: Get version and configure for environment | ||
| id: version | ||
| run: | | ||
| # Get version from git tags | ||
| BASE_VERSION=$(git describe --tags --always --match="*.*.*" | sed 's/^v//') | ||
| if [[ -z "$BASE_VERSION" || "$BASE_VERSION" == *"-"* ]]; then | ||
| # Fallback: use the latest tag or default | ||
| BASE_VERSION=$(git tag --sort=-version:refname | head -n1 | sed 's/^v//') | ||
| if [[ -z "$BASE_VERSION" ]]; then | ||
| BASE_VERSION="1.0.0rc4" | ||
| fi | ||
| fi | ||
| echo "Base version: $BASE_VERSION" | ||
|
|
||
| if [[ "${{ steps.determine-env.outputs.environment }}" == "test" ]]; then | ||
| # Test environment: append .devN | ||
| VERSION="${BASE_VERSION}.dev${{ github.run_number }}" | ||
| echo "Development version: $VERSION" | ||
| echo "SETUPTOOLS_SCM_PRETEND_VERSION=${VERSION}" >> $GITHUB_ENV | ||
| else | ||
| # Production environment: use version as-is | ||
| VERSION="${BASE_VERSION}" | ||
| echo "Production version: $VERSION" | ||
|
|
||
| # Verify no dev suffix for production | ||
| if [[ "$VERSION" =~ "dev" ]]; then | ||
| echo "Error: Version contains 'dev' suffix. Production releases must be clean versions." | ||
| echo "Current version: $VERSION" | ||
| echo "Please create a git tag (e.g., v1.0.0) on the release branch." | ||
| exit 1 | ||
| fi | ||
| fi | ||
|
|
||
| echo "version=${VERSION}" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Build package | ||
| run: python -m build | ||
|
|
||
| - name: Check package | ||
| run: | | ||
| twine check dist/* | ||
| ls -lh dist/ | ||
| echo "Package version: ${{ steps.version.outputs.version }}" | ||
|
|
||
| - name: Upload artifacts | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: dist-${{ steps.determine-env.outputs.environment }} | ||
| path: dist/ | ||
|
|
||
| publish-test: | ||
| needs: build | ||
| if: needs.build.outputs.environment == 'test' | ||
| runs-on: ubuntu-latest | ||
| environment: | ||
| name: test | ||
| url: https://test.pypi.org/project/workato-platform-cli/ | ||
|
|
||
| permissions: | ||
| id-token: write # Required for trusted publishing | ||
|
|
||
| steps: | ||
| - name: Download artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: dist-test | ||
| path: dist/ | ||
|
|
||
| - name: Publish to Test PyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 | ||
| with: | ||
| repository-url: https://test.pypi.org/legacy/ | ||
| skip-existing: true | ||
| print-hash: true | ||
|
|
||
| - name: Set up Python for testing | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: '3.11' | ||
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@v5 | ||
| with: | ||
| enable-cache: true | ||
| cache-dependency-glob: "pyproject.toml" | ||
|
|
||
| - name: Test installation | ||
| run: | | ||
| echo "Waiting for Test PyPI to process the package..." | ||
| sleep 30 | ||
|
|
||
| echo "Attempting to install latest workato-platform-cli from TestPyPI" | ||
| uv pip install --system \ | ||
| --index-url https://test.pypi.org/simple/ \ | ||
| --extra-index-url https://pypi.org/simple/ \ | ||
| workato-platform-cli || echo "Package not yet available on Test PyPI" | ||
|
|
||
| # Verify CLI if installation succeeded | ||
| workato --version || echo "CLI check skipped" | ||
|
|
||
| publish-release: | ||
| needs: build | ||
| if: needs.build.outputs.environment == 'release' | ||
| runs-on: ubuntu-latest | ||
| environment: | ||
| name: release | ||
| url: https://pypi.org/project/workato-platform-cli/ | ||
|
|
||
| permissions: | ||
| id-token: write # Required for trusted publishing | ||
| contents: write # For creating GitHub releases | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Download artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: dist-release | ||
| path: dist/ | ||
|
|
||
| - name: Publish to PyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 | ||
| with: | ||
| print-hash: true | ||
|
|
||
| - name: Create GitHub Release | ||
| if: startsWith(github.ref, 'refs/tags/') | ||
| uses: softprops/action-gh-release@v1 | ||
| with: | ||
| files: dist/* | ||
| generate_release_notes: true | ||
| draft: false | ||
| prerelease: false | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Copilot Autofix
AI 3 months ago
To fix the problem, you should add an explicit
permissions:block to thebuildjob in the workflow YAML (.github/workflows/pypi.yml). This block should specify only the permissions needed by the build job. In practice, for jobs that just need access to the code (e.g., checkout),contents: readis sufficient.Add the following beneath line 23 (
runs-on: ubuntu-latest):This change explicitly ensures that this job’s GITHUB_TOKEN can only read repository contents, and cannot write or modify anything, reducing the risk of privilege escalation or unintended actions.