ci: avoid secrets context in if conditions #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: write | |
| id-token: write | |
| concurrency: | |
| group: release-main | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| # Avoid release loops when this workflow pushes the version bump commit. | |
| if: ${{ github.actor != 'github-actions[bot]' }} | |
| runs-on: ubuntu-latest | |
| env: | |
| PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| version: "latest" | |
| - name: Set up Python | |
| run: uv python install 3.11 | |
| - name: Install dependencies | |
| run: uv sync --all-extras | |
| - name: Run pre-commit | |
| run: uv run pre-commit run --all-files | |
| - name: Run tests | |
| run: uv run pytest tests/ -v | |
| - name: Bump patch version | |
| id: bump | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| CURRENT_VERSION="$(python3 - <<'PY' | |
| import re | |
| from pathlib import Path | |
| text = Path("pyproject.toml").read_text(encoding="utf-8") | |
| m = re.search(r'(?m)^version\s*=\s*"([^"]+)"\s*$', text) | |
| if not m: | |
| raise SystemExit("ERROR: Could not find version in pyproject.toml") | |
| print(m.group(1)) | |
| PY | |
| )" | |
| python3 - <<PY | |
| import re | |
| from pathlib import Path | |
| def bump_patch(version: str) -> str: | |
| parts = version.split(".") | |
| if len(parts) != 3 or not all(p.isdigit() for p in parts): | |
| raise SystemExit(f"ERROR: Unsupported version format: {version!r}") | |
| parts[2] = str(int(parts[2]) + 1) | |
| return ".".join(parts) | |
| current = "${CURRENT_VERSION}" | |
| new = bump_patch(current) | |
| pyproject = Path("pyproject.toml") | |
| py_text = pyproject.read_text(encoding="utf-8") | |
| py_text2, n = re.subn( | |
| r'(?m)^version\s*=\s*"[^"]+"\s*$', | |
| f'version = \"{new}\"', | |
| py_text, | |
| count=1, | |
| ) | |
| if n != 1: | |
| raise SystemExit("ERROR: Failed to update version in pyproject.toml") | |
| pyproject.write_text(py_text2, encoding="utf-8") | |
| init_path = Path("src/posecheck_fast/__init__.py") | |
| init_text = init_path.read_text(encoding="utf-8") | |
| init_text2, n2 = re.subn( | |
| r'(?m)^__version__\s*=\s*"[^"]+"\s*$', | |
| f'__version__ = \"{new}\"', | |
| init_text, | |
| count=1, | |
| ) | |
| if n2 != 1: | |
| raise SystemExit("ERROR: Failed to update __version__ in src/posecheck_fast/__init__.py") | |
| init_path.write_text(init_text2, encoding="utf-8") | |
| print(f"bumped {current} -> {new}") | |
| print(new) | |
| PY | |
| NEW_VERSION="$(grep -m1 '^version' pyproject.toml | sed 's/.*\"\\(.*\\)\"/\\1/')" | |
| echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Commit version bump | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add pyproject.toml src/posecheck_fast/__init__.py | |
| git commit -m "chore(release): v${{ steps.bump.outputs.version }}" | |
| git push origin HEAD:main | |
| - name: Build package | |
| run: uv build | |
| - name: Publish to PyPI (token) | |
| if: ${{ env.PYPI_API_TOKEN != '' }} | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| password: ${{ env.PYPI_API_TOKEN }} | |
| - name: Publish to PyPI (trusted publishing) | |
| if: ${{ env.PYPI_API_TOKEN == '' }} | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| - name: Create GitHub release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TAG: v${{ steps.bump.outputs.version }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| TARGET="$(git rev-parse HEAD)" | |
| if git ls-remote --tags origin "$TAG" | grep -q "$TAG"; then | |
| echo "Tag already exists: $TAG" | |
| exit 0 | |
| fi | |
| gh release create "$TAG" \ | |
| --title "$TAG" \ | |
| --generate-notes \ | |
| --target "$TARGET" |