agentseam/.github/workflows/release.yml at main · open-coder-ai/agentseam · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
name: Release

# A pushed v* tag builds sdist+wheel and publishes to PyPI via trusted publishing (OIDC) --
# no stored token. build re-runs the test suite on the exact tagged commit rather than
# trusting that main's own CI run for the same SHA is still the current truth by the time
# this fires; publish is gated on that job, so a red build never reaches PyPI.
#
# Requires the owner to register this repo/workflow as a trusted publisher on PyPI first
# (pypi.org -> the `agentseam` project -> Publishing -> add a GitHub publisher: owner
# `open-coder-ai`, repo `agentseam`, workflow `release.yml`, environment `pypi`). Until
# that is done, `publish` fails at the upload step with everything else here unaffected --
# the build, and the tag it built from, are still valid and ready to retry.

on:
  push:
    tags: ["v*"]

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
        with:
          python-version: "3.11"
      - run: pip install --require-hashes -r .github/requirements/dev.txt
      - run: pip install --no-deps -e .
      - run: pytest -q
      # Installed together, and before the build, so the tools that produce and
      # inspect the artifact published to PyPI are the hash-verified ones.
      - name: Install the build and check tooling
        run: pip install --require-hashes -r .github/requirements/build.txt
      - name: Build sdist and wheel
        run: python -m build
      - name: Check the built distributions
        run: twine check dist/*
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dist
          path: dist/

  publish:
    needs: build
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      # OIDC token for PyPI trusted publishing -- the whole point of this workflow existing
      # is that no PyPI API token is stored as a secret.
      id-token: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: dist
          path: dist/
      # v1.9.0 bundled a twine that only understands Metadata-Version up to 2.3 and
      # rejected this project's wheel with "Metadata is missing required fields: Name,
      # Version" -- the fields are present, that twine just cannot parse a 2.4 file.
      # Our metadata is 2.4 because the PEP 639 `license = "Apache-2.0"` expression
      # emits License-Expression. This pin is the one chock already publishes with.
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # release/v1