Box/.github/workflows/pythonpublish.yml at master · cdgriffith/Box · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
# Builds and publishes to PyPI when a GitHub release is created.
# Every build job runs without secrets. A single publish job, whose only permission is
# id-token: write, uploads all distributions via PyPI Trusted Publishing (OIDC), so no PyPI
# password or token is stored in GitHub: https://docs.pypi.org/trusted-publishers/
# All actions are pinned to full commit SHAs; the comment shows the matching release tag.

name: Upload Python Package

on:
  release:
    types: [ created ]

permissions: {}

jobs:
  build-generic:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false

    - name: Set up Python
      uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
      with:
        python-version: '3.15'

    - name: Install uv
      uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3

    # Isolated build: Cython is not part of the build requirements, so this is the pure Python sdist and wheel
    - name: Build and check
      run: |
        uv build
        uvx twine==7.0.0 check dist/*

    - name: Upload distribution artifact
      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
      with:
        name: dist-generic
        path: dist/*
        if-no-files-found: error

  build-cython:
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]
        python-version: ["3.11", "3.12", "3.13", "3.14", "3.15"]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    permissions:
      contents: read

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - name: Set up Python ${{ matrix.python-version }}
      id: setup-python
      uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
      with:
        python-version: ${{ matrix.python-version }}
    - name: Install uv
      uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
    - name: Install build dependencies
      run: |
        uv venv --python "${{ steps.setup-python.outputs.python-path }}"
        uv pip install "setuptools>=77" wheel "Cython>=3.3.1"
    # No build isolation so the Cython installed above is used to build the compiled wheel
    - name: Build and check
      run: |
        uv build --wheel --no-build-isolation
        uvx twine==7.0.0 check dist/*
    - name: Upload wheel artifact
      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
      with:
        name: dist-cython-${{ matrix.os }}-${{ matrix.python-version }}
        path: dist/*.whl
        if-no-files-found: error

  build-cython-manylinux:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with:
        persist-credentials: false
    - name: Install uv
      uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3

    # Build targets and test commands are configured in [tool.cibuildwheel] in pyproject.toml
    - name: Build wheels
      run: uvx cibuildwheel==4.3.5 --output-dir dist

    - name: Upload wheel artifact
      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
      with:
        name: dist-cython-manylinux
        path: dist/*-manylinux*.whl
        if-no-files-found: error

  # Publishes only after every build succeeds, so a release is never left half uploaded
  publish:
    needs: [ build-generic, build-cython, build-cython-manylinux ]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment:
      name: pypi
      url: https://pypi.org/p/python-box
    permissions:
      id-token: write  # Required for Trusted Publishing; the only permission this job has

    steps:
    - name: Download all distributions
      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
      with:
        pattern: dist-*
        path: dist
        merge-multiple: true

    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3