diff options
Diffstat (limited to '.github')
| -rw-r--r-- | .github/workflows/github-actions.yml | 35 | ||||
| -rw-r--r-- | .github/workflows/python-publish.yml | 33 |
2 files changed, 50 insertions, 18 deletions
diff --git a/.github/workflows/github-actions.yml b/.github/workflows/github-actions.yml index f9f49d6..0fcb6bf 100644 --- a/.github/workflows/github-actions.yml +++ b/.github/workflows/github-actions.yml @@ -21,6 +21,10 @@ jobs: python: '3.11' command: 'uv run pyright edify' os: 'ubuntu-latest' + - name: 'public-surface' + python: '3.11' + command: 'uv run python tools/surface.py --check' + os: 'ubuntu-latest' - name: 'docs' python: '3.11' command: 'uv run --group docs sphinx-build -b html docs dist/docs && uv run --group docs sphinx-build -b linkcheck docs dist/docs' @@ -59,6 +63,37 @@ jobs: - name: ${{ matrix.name }} run: ${{ matrix.command }} + surface-migration-gate: + name: 'public-surface migration gate' + runs-on: ubuntu-latest + if: github.event_name == 'pull_request' + timeout-minutes: 10 + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + with: + fetch-depth: 0 + - name: require a changes/ fragment when the public surface moves + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + PR_TITLE: ${{ github.event.pull_request.title }} + run: | + if echo "$PR_TITLE" | grep -q '\[no-migration\]'; then + echo "PR marked [no-migration]; skipping the fragment requirement." + exit 0 + fi + if git diff --quiet "$BASE_SHA" "$HEAD_SHA" -- .public-surface; then + echo "Public surface unchanged; no fragment required." + exit 0 + fi + added_fragments=$(git diff --name-only --diff-filter=A "$BASE_SHA" "$HEAD_SHA" -- 'changes/*.rst' | grep -v 'changes/README.rst' || true) + if [ -z "$added_fragments" ]; then + echo "::error::.public-surface changed but no changes/ fragment was added. Add a fragment describing the migration, or mark the PR title with [no-migration]." + exit 1 + fi + echo "Public surface changed and a changes/ fragment accompanies it:" + echo "$added_fragments" + install-without-regex-extra: name: 'install: edify (no [regex] extra)' runs-on: ubuntu-latest diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index f47ac56..d832902 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -1,10 +1,7 @@ -# This workflow will upload a Python Package using Twine when a release is created -# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries - -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. +# Publishes the Python package to PyPI via Trusted Publishing (OIDC). +# No long-lived API token: PyPI verifies the GitHub Actions OIDC identity of +# this workflow. Configure the trusted publisher once in the PyPI project +# settings (owner: luciferreeves, repo: edify, workflow: python-publish.yml). name: Upload Python Package @@ -18,23 +15,23 @@ permissions: jobs: deploy: - runs-on: ubuntu-latest - + environment: + name: pypi + url: https://pypi.org/p/edify + permissions: + id-token: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + with: + fetch-depth: 0 - name: Set up Python uses: actions/setup-python@v5 with: python-version: '3.x' - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install build + - name: Install build backend + run: python -m pip install --upgrade pip build - name: Build package run: python -m build - - name: Publish package + - name: Publish package to PyPI via Trusted Publishing uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 - with: - user: __token__ - password: ${{ secrets.PYPI_API_TOKEN }} |