Skip to content

Commit 9008a37

Browse files
cortadocodescortadocodes
authored
MRG: Merge pull request #70 from octue/use-pypi-trusted-publisher
Use trusted publisher to publish to PyPI in `cd` workflow
2 parents 9a2125a + 55d01cf commit 9008a37

File tree

4 files changed

+164
-42
lines changed

4 files changed

+164
-42
lines changed

‎.github/workflows/cd.yml

+31-33
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
name: cd
2+
description: This workflow releases a new version of the package before publishing it to PyPI.
23

34
on:
45
pull_request:
@@ -7,53 +8,50 @@ on:
78
- main
89

910
jobs:
10-
publish:
11-
# This job will only run if the PR has been merged (and not closed without merging).
12-
if: "github.event.pull_request.merged == true && !contains(github.event.pull_request.head.message, 'skipci')"
13-
runs-on: ubuntu-latest
14-
steps:
15-
- name: Checkout repository
16-
uses: actions/checkout@v3
17-
18-
- name: Test package is publishable with PyPI test server
19-
uses: JRubics/[email protected]
20-
with:
21-
python_version: '3.9'
22-
pypi_token: ${{ secrets.TEST_PYPI_TOKEN }}
23-
repository_name: 'testpypi'
24-
repository_url: 'https://test.pypi.org/legacy/'
25-
26-
- name: Publish latest package to PyPI
27-
uses: JRubics/[email protected]
28-
with:
29-
python_version: '3.9'
30-
poetry_version: '==1.4.2' # (PIP version specifier syntax)
31-
pypi_token: ${{ secrets.PYPI_TOKEN }}
32-
ignore_dev_requirements: 'yes'
33-
3411
release:
35-
# This job will only run if the PR has been merged (and not closed without merging).
36-
if: "github.event.pull_request.merged == true && !contains(github.event.pull_request.head.message, 'skipci')"
12+
if: "${{ github.event.pull_request.merged == true }}"
3713
runs-on: ubuntu-latest
38-
needs: [publish]
3914
steps:
40-
- name: Checkout code
41-
uses: actions/checkout@v3
15+
- name: Checkout repository
16+
uses: actions/checkout@v4
4217

4318
- name: Install poetry
44-
run: pip install poetry
19+
uses: snok/[email protected]
20+
21+
- name: Check pyproject.toml file
22+
run: poetry check
4523

4624
- name: Get package version
47-
id: version
48-
run: echo "::set-output name=package_version::$(poetry version -s)"
25+
id: get-package-version
26+
run: echo "package_version=$(poetry version -s)" >> $GITHUB_OUTPUT
4927

5028
- name: Create release
5129
uses: actions/create-release@v1
5230
env:
5331
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, no need to create your own.
5432
with:
55-
tag_name: ${{ steps.version.outputs.package_version }}
33+
tag_name: ${{ steps.get-package-version.outputs.package_version }}
5634
release_name: ${{ github.event.pull_request.title }}
5735
body: ${{ github.event.pull_request.body }}
5836
draft: false
5937
prerelease: false
38+
39+
publish:
40+
needs: release
41+
runs-on: ubuntu-latest
42+
permissions:
43+
id-token: write
44+
contents: read
45+
46+
steps:
47+
- name: Checkout repository
48+
uses: actions/checkout@v4
49+
50+
- name: Install poetry
51+
uses: snok/[email protected]
52+
53+
- name: Build a binary wheel and a source tarball
54+
run: poetry build
55+
56+
- name: Publish package distributions to PyPI
57+
uses: pypa/[email protected]

‎.github/workflows/ci.yml

+42-8
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,11 @@ on:
77
- main
88

99
pull_request:
10-
types: [opened, synchronize, reopened]
10+
types:
11+
- opened
12+
- reopened
13+
- synchronize
14+
- ready_for_review
1115
branches:
1216
- main
1317

@@ -19,8 +23,15 @@ on:
1923
default: false
2024

2125
jobs:
26+
check-semantic-version:
27+
if: github.event.pull_request.draft == false
28+
uses: octue/workflows/.github/workflows/check-semantic-version.yml@main
29+
with:
30+
path: pyproject.toml
31+
breaking_change_indicated_by: minor
32+
2233
run-tests:
23-
if: "!contains(github.event.head_commit.message, 'skipci')"
34+
if: github.event.pull_request.draft == false
2435
strategy:
2536
fail-fast: true
2637
matrix:
@@ -45,17 +56,17 @@ jobs:
4556
--health-retries 5
4657
4758
steps:
48-
- name: Checkout Repository
49-
uses: actions/checkout@v3
59+
- name: Checkout repository
60+
uses: actions/checkout@v4
5061

51-
- name: Setup Python ${{ matrix.python }}
52-
uses: actions/setup-python@v3
62+
- name: Setup python ${{ matrix.python }}
63+
uses: actions/setup-python@v5
5364
with:
5465
python-version: ${{ matrix.python }}
5566

5667
# See the repo of this action for way more advanced caching strategies than used here
57-
- name: Install Poetry
58-
uses: snok/install-poetry@v1
68+
- name: Install poetry
69+
uses: snok/install-poetry@v1.4.1
5970

6071
# For more advanced configuration see https://github.com/ymyzk/tox-gh-actions
6172
- name: Install tox and plugins
@@ -81,3 +92,26 @@ jobs:
8192
# Token is not required for public repos, but see:
8293
# https://community.codecov.com/t/upload-issues-unable-to-locate-build-via-github-actions-api/3954
8394
token: ${{ secrets.CODECOV_TOKEN }}
95+
96+
test-publish:
97+
runs-on: ubuntu-latest
98+
needs: run-tests
99+
permissions:
100+
id-token: write
101+
contents: read
102+
steps:
103+
- name: Checkout repository
104+
uses: actions/checkout@v4
105+
106+
- name: Install poetry
107+
uses: snok/[email protected]
108+
109+
- name: Build a binary wheel and a source tarball
110+
run: poetry build
111+
112+
- name: Test package is publishable with PyPI test server
113+
uses: pypa/[email protected]
114+
with:
115+
repository-url: https://test.pypi.org/legacy/
116+
skip-existing: true
117+
verbose: true

‎.github/workflows/codeql.yml

+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL Advanced"
13+
14+
on:
15+
push:
16+
branches: [ "main" ]
17+
18+
jobs:
19+
analyze:
20+
name: Analyze (${{ matrix.language }})
21+
# Runner size impacts CodeQL analysis time. To learn more, please see:
22+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
23+
# - https://gh.io/supported-runners-and-hardware-resources
24+
# - https://gh.io/using-larger-runners (GitHub.com only)
25+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
26+
runs-on: ubuntu-latest
27+
permissions:
28+
# required for all workflows
29+
security-events: write
30+
31+
# required to fetch internal or private CodeQL packs
32+
packages: read
33+
34+
# only required for workflows in private repositories
35+
actions: read
36+
contents: read
37+
38+
strategy:
39+
fail-fast: false
40+
matrix:
41+
include:
42+
- language: javascript-typescript
43+
build-mode: none
44+
- language: python
45+
build-mode: none
46+
# CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
47+
# Use `c-cpp` to analyze code written in C, C++ or both
48+
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
49+
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
50+
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
51+
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
52+
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
53+
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
54+
steps:
55+
- name: Checkout repository
56+
uses: actions/checkout@v4
57+
58+
# Initializes the CodeQL tools for scanning.
59+
- name: Initialize CodeQL
60+
uses: github/codeql-action/init@v3
61+
with:
62+
languages: ${{ matrix.language }}
63+
build-mode: ${{ matrix.build-mode }}
64+
# If you wish to specify custom queries, you can do so here or in a config file.
65+
# By default, queries listed here will override any specified in a config file.
66+
# Prefix the list here with "+" to use these queries and those in the config file.
67+
68+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
69+
# queries: security-extended,security-and-quality
70+
71+
# If the analyze step fails for one of the languages you are analyzing with
72+
# "We were unable to automatically build your code", modify the matrix above
73+
# to set the build mode to "manual" for that language. Then modify this step
74+
# to build your code.
75+
# ℹ️ Command-line programs to run using the OS shell.
76+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
77+
- if: matrix.build-mode == 'manual'
78+
shell: bash
79+
run: |
80+
echo 'If you are using a "manual" build mode for one or more of the' \
81+
'languages you are analyzing, replace this with the commands to build' \
82+
'your code, for example:'
83+
echo ' make bootstrap'
84+
echo ' make release'
85+
exit 1
86+
87+
- name: Perform CodeQL Analysis
88+
uses: github/codeql-action/analyze@v3
89+
with:
90+
category: "/language:${{matrix.language}}"

‎pyproject.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[tool.poetry]
22
name = "django-gcp"
3-
version = "0.12.0"
3+
version = "0.12.1"
44
description = "Utilities to run Django on Google Cloud Platform"
55
authors = ["Tom Clark"]
66
license = "MIT"

0 commit comments

Comments
 (0)