python-client/.github/workflows/publish.yml at master · onekey-sec/python-client · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
name: Publish Python distribution

on:
  push:
    branches: [master]
    tags: ["*"]

permissions:
  contents: read

# Publishing runs must not be cancelled: every default-branch push gets a
# distinct TestPyPI version.
concurrency:
  group: ${{ github.workflow }}-${{ github.run_id }}
  cancel-in-progress: false

env:
  PACKAGE_NAME: onekey_client

jobs:
  build:
    name: Build distribution
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"
      - name: Build distribution
        run: uv build
      - name: Store distribution packages
        uses: actions/upload-artifact@v5
        with:
          name: python-package-distributions
          path: dist/

  publish-to-testpypi:
    name: Publish distribution to TestPyPI
    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: testpypi
      url: https://test.pypi.org/p/onekey_client
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v6
        with:
          name: python-package-distributions
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/

  publish-to-pypi:
    name: Publish distribution to PyPI
    needs: build
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/onekey_client
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v6
        with:
          name: python-package-distributions
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1

  release:
    name: Create GitHub Release
    if: startsWith(github.ref, 'refs/tags/')
    needs: [build, publish-to-pypi]
    runs-on: ubuntu-latest
    permissions:
      attestations: write
      contents: write
      id-token: write
    steps:
      - uses: actions/download-artifact@v6
        with:
          name: python-package-distributions
          path: dist/
      - uses: actions/attest-build-provenance@v3
        with:
          subject-path: dist/*
      - env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --generate-notes dist/*