publish #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publish `blockchain0x` to PyPI via Trusted Publisher OIDC. | |
| # Manual dispatch only. | |
| # | |
| # Requires PyPI Trusted Publisher binding on | |
| # https://pypi.org/manage/project/blockchain0x/settings/publishing/: | |
| # Publisher: GitHub | |
| # Owner: Tosh-Labs | |
| # Repository name: blockchain0x-python | |
| # Workflow filename: publish.yml | |
| # Environment: pypi | |
| # | |
| # This file is mirrored from the private monorepo | |
| # `Tosh-Labs/blockchain0x-app:packages/sdk-python/.public-templates/.github/workflows/publish.yml` | |
| # by the `mirror-sdk-python` workflow there. Do not edit it directly in | |
| # the public repo - changes will be overwritten on the next mirror. | |
| name: publish | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'PyPI release classifier (informational only; pypi tracks pre-release vs final from the version string itself, e.g. 0.0.1a0 = alpha).' | |
| required: true | |
| default: 'alpha' | |
| type: choice | |
| options: | |
| - alpha | |
| - beta | |
| - latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| environment: pypi | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: install build tooling | |
| run: | | |
| python -m pip install --upgrade pip | |
| python -m pip install build twine | |
| - name: build sdist + wheel | |
| run: | | |
| python -m build | |
| ls -la dist/ | |
| - name: validate distribution metadata | |
| # twine check catches README markup errors, missing classifiers, | |
| # and other PyPI-rejecting issues before the upload itself. | |
| run: python -m twine check dist/* | |
| - name: publish to PyPI (Trusted Publisher OIDC) | |
| # No PYPI_TOKEN involved - the action exchanges the GitHub OIDC | |
| # token for a short-lived PyPI publish token via the Trusted | |
| # Publisher binding configured on pypi.org. The binding is the | |
| # source of trust; this workflow file's PATH on the public repo | |
| # is part of that binding. | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| # No `password:` field - OIDC is used when omitted. | |
| # `print-hash: true` records the sha256 of every uploaded | |
| # artefact in the run log for provenance auditing. | |
| print-hash: true |