|
| 1 | +--- |
| 2 | +name: "Release" |
| 3 | +on: # yamllint disable-line rule:truthy rule:comments |
| 4 | + release: |
| 5 | + types: ["published"] |
| 6 | + |
| 7 | +jobs: |
| 8 | + build: |
| 9 | + name: "Build package with poetry" |
| 10 | + runs-on: "ubuntu-latest" |
| 11 | + if: "startsWith(github.ref, 'refs/tags/v')" |
| 12 | + steps: |
| 13 | + - uses: "actions/checkout@v4" |
| 14 | + - name: "Setup environment" |
| 15 | + uses: "networktocode/gh-action-setup-poetry-environment@v6" |
| 16 | + with: |
| 17 | + poetry-version: "2.1.3" |
| 18 | + python-version: "3.13" |
| 19 | + poetry-install-options: "--no-root" |
| 20 | + - name: "Build Documentation" |
| 21 | + run: "poetry run invoke build-and-check-docs" |
| 22 | + - name: "Run Poetry Build" |
| 23 | + run: "poetry build" |
| 24 | + |
| 25 | + - name: "Check that the release tag matches the version in pyproject.toml" |
| 26 | + run: | |
| 27 | + if [ "${{ github.ref_name }}" != "v$(poetry version -s)" ]; then exit 1; fi |
| 28 | +
|
| 29 | + - uses: "actions/upload-artifact@v4" |
| 30 | + with: |
| 31 | + name: "distfiles" |
| 32 | + path: "dist/" |
| 33 | + if-no-files-found: "error" |
| 34 | + |
| 35 | + publish-github: |
| 36 | + name: "Publish to GitHub" |
| 37 | + runs-on: "ubuntu-latest" |
| 38 | + if: "startsWith(github.ref, 'refs/tags/v')" |
| 39 | + permissions: |
| 40 | + contents: "write" |
| 41 | + needs: "build" |
| 42 | + steps: |
| 43 | + - uses: "actions/checkout@v4" |
| 44 | + - name: "Retrieve built package from cache" |
| 45 | + uses: "actions/download-artifact@v4" |
| 46 | + with: |
| 47 | + name: "distfiles" |
| 48 | + path: "dist/" |
| 49 | + |
| 50 | + - name: "Upload binaries to release" |
| 51 | + run: "gh release upload ${{ github.ref_name }} dist/*.{tar.gz,whl}" |
| 52 | + env: |
| 53 | + GH_TOKEN: "${{ secrets.NTC_GITHUB_TOKEN }}" |
| 54 | + |
| 55 | + publish-pypi: |
| 56 | + name: "Push Package to PyPI" |
| 57 | + runs-on: "ubuntu-latest" |
| 58 | + if: "startsWith(github.ref, 'refs/tags/v')" |
| 59 | + needs: "build" |
| 60 | + environment: "pypi" |
| 61 | + permissions: |
| 62 | + # IMPORTANT: this permission is mandatory for Trusted Publishing |
| 63 | + id-token: "write" |
| 64 | + steps: |
| 65 | + - name: "Retrieve built package from cache" |
| 66 | + uses: "actions/download-artifact@v4" |
| 67 | + with: |
| 68 | + name: "distfiles" |
| 69 | + path: "dist/" |
| 70 | + |
| 71 | + - name: "Publish package distributions to PyPI" |
| 72 | + uses: "pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e" # v1.13.0 |
| 73 | + |
| 74 | + slack-notify: |
| 75 | + needs: |
| 76 | + - "publish-github" |
| 77 | + - "publish-pypi" |
| 78 | + runs-on: "ubuntu-latest" |
| 79 | + env: |
| 80 | + # Secrets cannot be directly referenced in if: conditionals. They must be set as a job env var first. |
| 81 | + # Ref: https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#example-using-secrets |
| 82 | + SLACK_WEBHOOK_URL: "${{ secrets.OSS_PYPI_SLACK_WEBHOOK_URL }}" |
| 83 | + SLACK_WEBHOOK_TYPE: "INCOMING_WEBHOOK" |
| 84 | + SLACK_MESSAGE: >- |
| 85 | + *NOTIFICATION: NEW-RELEASE-PUBLISHED*\n |
| 86 | + Repository: <${{ github.server_url }}/${{ github.repository }}|${{ github.repository }}>\n |
| 87 | + Release: <${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ github.ref_name }}|${{ github.ref_name }}>\n |
| 88 | + Published by: <${{ github.server_url }}/${{ github.actor }}|${{ github.actor }}> |
| 89 | + steps: |
| 90 | + - name: "Send a notification to Slack" |
| 91 | + if: "${{ env.SLACK_WEBHOOK_URL != '' }}" |
| 92 | + uses: "slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3" # v1.27.1 |
| 93 | + with: |
| 94 | + payload: | |
| 95 | + { |
| 96 | + "text": "${{ env.SLACK_MESSAGE }}", |
| 97 | + "blocks": [ |
| 98 | + { |
| 99 | + "type": "section", |
| 100 | + "text": { |
| 101 | + "type": "mrkdwn", |
| 102 | + "text": "${{ env.SLACK_MESSAGE }}" |
| 103 | + } |
| 104 | + } |
| 105 | + ] |
| 106 | + } |
0 commit comments