Skip to content

Commit bf23a30

Browse files
birdcargjtorikian
birdcar
and
gjtorikian
authored
ci: Migrate release workflow to Trusted Publishing (#517)
* ci: Migrate release workflow to Trusted Publishing - Replace Twine/token-based auth with PyPI Trusted Publishing - Add smoke tests to verify wheel and sdist before publishing - Run smoke tests against all supported Python versions (3.8-3.14) - Use matrix strategy for parallel testing across versions - Use uv publish for streamlined publishing Workflow structure: 1. build: Create wheel and sdist artifacts 2. smoke-test: Test on Python 3.8-3.14 in parallel 3. publish: Upload to PyPI after all tests pass Smoke tests verify: - Package imports correctly - Both sync/async clients instantiate - All module properties accessible - Core types and exceptions importable - Dependencies properly bundled - py.typed marker present * chore: ignore unused import lint errors in smoke test * ci: configure explicit Python version for smoke tests Pass python-version to setup-uv action to ensure the correct Python version is installed before running smoke tests. Enable cache-python to speed up subsequent workflow runs. * automate release flow --------- Co-authored-by: Garen J. Torikian <gjtorikian@users.noreply.github.com>
1 parent 3248f49 commit bf23a30

File tree

4 files changed

+422
-16
lines changed

4 files changed

+422
-16
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,3 +39,26 @@ jobs:
3939

4040
- name: Test
4141
run: uv run pytest
42+
43+
smoke-test:
44+
name: Smoke test (Python ${{ matrix.python }})
45+
if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'version-bump')
46+
runs-on: ubuntu-latest
47+
strategy:
48+
fail-fast: false
49+
matrix:
50+
python: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
51+
steps:
52+
- uses: actions/checkout@v3
53+
- uses: astral-sh/setup-uv@v7
54+
with:
55+
python-version: ${{ matrix.python }}
56+
57+
- name: Build
58+
run: uv build
59+
60+
- name: Smoke test (wheel)
61+
run: uv run --isolated --no-project --with dist/*.whl tests/smoke_test.py
62+
63+
- name: Smoke test (sdist)
64+
run: uv run --isolated --no-project --with dist/*.tar.gz tests/smoke_test.py

‎.github/workflows/release.yml‎

Lines changed: 41 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,61 @@
11
name: Release
22

33
on:
4-
# Support manually pushing a new release
5-
workflow_dispatch: {}
6-
# Trigger when a release or pre-release is published
7-
release:
8-
types: [published]
4+
pull_request:
5+
types: [closed]
6+
branches: [main]
97

108
defaults:
119
run:
1210
shell: bash
1311

1412
jobs:
15-
pypi:
13+
create-release:
14+
name: Create GitHub Release
15+
if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'version-bump')
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: write
19+
steps:
20+
- name: Generate token
21+
id: generate-token
22+
uses: actions/create-github-app-token@v1
23+
with:
24+
app-id: ${{ vars.WORKOS_BOT_APP_ID }}
25+
private-key: ${{ secrets.WORKOS_BOT_PRIVATE_KEY }}
26+
27+
- name: Checkout
28+
uses: actions/checkout@v4
29+
with:
30+
token: ${{ steps.generate-token.outputs.token }}
31+
32+
- name: Get version from pyproject.toml
33+
id: get-version
34+
run: |
35+
VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
36+
echo "version=$VERSION" >> $GITHUB_OUTPUT
37+
38+
- name: Create Release
39+
uses: softprops/action-gh-release@v2
40+
with:
41+
tag_name: v${{ steps.get-version.outputs.version }}
42+
name: v${{ steps.get-version.outputs.version }}
43+
generate_release_notes: true
44+
token: ${{ steps.generate-token.outputs.token }}
45+
46+
publish:
1647
name: Publish to PyPI
48+
needs: create-release
1749
runs-on: ubuntu-latest
1850
permissions:
51+
id-token: write
1952
contents: read
2053
steps:
2154
- name: Checkout
22-
uses: actions/checkout@v5
55+
uses: actions/checkout@v4
2356
- name: Install uv
2457
uses: astral-sh/setup-uv@v6
25-
- name: Install dependencies
26-
run: uv sync --locked
27-
- name: Test
28-
run: uv run pytest
2958
- name: Build
3059
run: uv build
3160
- name: Publish
32-
env:
33-
TWINE_NON_INTERACTIVE: true
34-
TWINE_USERNAME: "__token__"
35-
TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
36-
run: uvx twine upload dist/* --skip-existing
61+
run: uv publish

‎.github/workflows/version-bump.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: Version Bump
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
bump_type:
7+
description: "Version bump type"
8+
required: true
9+
type: choice
10+
options:
11+
- patch
12+
- minor
13+
- major
14+
15+
jobs:
16+
bump-version:
17+
runs-on: ubuntu-latest
18+
permissions:
19+
contents: write
20+
pull-requests: write
21+
steps:
22+
- name: Generate token
23+
id: generate-token
24+
uses: actions/create-github-app-token@v1
25+
with:
26+
app-id: ${{ vars.WORKOS_BOT_APP_ID }}
27+
private-key: ${{ secrets.WORKOS_BOT_PRIVATE_KEY }}
28+
29+
- name: Checkout
30+
uses: actions/checkout@v4
31+
with:
32+
token: ${{ steps.generate-token.outputs.token }}
33+
34+
- name: Configure Git
35+
run: |
36+
git config user.name "workos-bot[bot]"
37+
git config user.email "workos-bot[bot]@users.noreply.github.com"
38+
39+
- name: Read current version
40+
id: current-version
41+
run: |
42+
CURRENT_VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
43+
echo "version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
44+
45+
- name: Bump version
46+
id: bump-version
47+
run: |
48+
CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
49+
IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT_VERSION"
50+
51+
case "${{ github.event.inputs.bump_type }}" in
52+
major)
53+
NEW_VERSION="$((MAJOR + 1)).0.0"
54+
;;
55+
minor)
56+
NEW_VERSION="$MAJOR.$((MINOR + 1)).0"
57+
;;
58+
patch)
59+
NEW_VERSION="$MAJOR.$MINOR.$((PATCH + 1))"
60+
;;
61+
esac
62+
63+
echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
64+
65+
- name: Install uv
66+
uses: astral-sh/setup-uv@v6
67+
68+
- name: Update version in pyproject.toml
69+
run: |
70+
sed -i 's/^version = ".*"/version = "${{ steps.bump-version.outputs.new_version }}"/' pyproject.toml
71+
72+
- name: Update uv.lock
73+
run: uv lock
74+
75+
- name: Create Pull Request
76+
uses: peter-evans/create-pull-request@v7
77+
with:
78+
token: ${{ steps.generate-token.outputs.token }}
79+
commit-message: "v${{ steps.bump-version.outputs.new_version }}"
80+
title: "v${{ steps.bump-version.outputs.new_version }}"
81+
body: |
82+
Bumps version from ${{ steps.current-version.outputs.version }} to ${{ steps.bump-version.outputs.new_version }}.
83+
84+
This PR was automatically created by the version-bump workflow.
85+
branch: version-bump-${{ steps.bump-version.outputs.new_version }}
86+
labels: version-bump

0 commit comments

Comments
 (0)