2 uses pinned in .github/workflows/publish.yml (1 upload at line 52, 1 download at line 64). v4 relies on a runtime API shape Gitea's act_runner v0.6.x doesn't fully support; v3 works end-to-end. YAML parse green. Sister PRs in molecule-controlplane (#18) and molecule-core (#18). Per internal#46 Phase 2 audit. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
70 lines
2.1 KiB
YAML
70 lines
2.1 KiB
YAML
name: Publish to PyPI
|
|
|
|
# Triggered on tag push (vX.Y.Z). Tag-on-push instead of release-creation
|
|
# is the cheaper UX — `git tag v0.1.0 && git push origin v0.1.0` ships
|
|
# without leaving the terminal.
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v[0-9]+.[0-9]+.[0-9]+"
|
|
- "v[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
|
|
|
|
permissions:
|
|
contents: read
|
|
# OIDC token for PyPI trusted-publisher auth — no secret token needed.
|
|
# PyPI side: register
|
|
# github.com/Molecule-AI/codex-channel-molecule
|
|
# workflow=publish.yml environment=pypi
|
|
# under "Trusted publisher management" on the codex-channel-molecule
|
|
# PyPI project page (see README "Releasing" section).
|
|
id-token: write
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Verify tag matches pyproject version
|
|
run: |
|
|
tag="${GITHUB_REF#refs/tags/v}"
|
|
pkg=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
|
|
if [ "$tag" != "$pkg" ]; then
|
|
echo "::error::tag $tag does not match pyproject version $pkg — aborting publish to keep PyPI in sync with git tags"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Build sdist + wheel
|
|
run: |
|
|
python -m pip install --upgrade pip build
|
|
python -m build
|
|
|
|
- name: Smoke-import the built wheel
|
|
run: |
|
|
python -m venv /tmp/install-test
|
|
/tmp/install-test/bin/pip install dist/*.whl
|
|
/tmp/install-test/bin/codex-channel-molecule --help
|
|
|
|
- uses: actions/upload-artifact@v3 # pinned to v3 for Gitea act_runner v0.6 compatibility (internal#46)
|
|
with:
|
|
name: dist
|
|
path: dist/
|
|
|
|
publish:
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
environment: pypi
|
|
permissions:
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/download-artifact@v3 # pinned to v3 for Gitea act_runner v0.6 compatibility (internal#46)
|
|
with:
|
|
name: dist
|
|
path: dist/
|
|
|
|
- uses: pypa/gh-action-pypi-publish@release/v1
|