dresber
94 lines
3.4 KiB
YAML
94 lines
3.4 KiB
YAML
name: Reusable Python Package Publish
|
|
|
|
# Builds a Python package with `python -m build` and uploads it to the Gitea PyPI registry with
|
|
# twine. Intended to run only on version tags (v*), alongside python-checks, so a package is
|
|
# never published without its tests passing.
|
|
#
|
|
# The caller gates this job on python-checks and on the tag ref, the same way docker-publish is
|
|
# gated. The job itself additionally refuses to publish when the git tag does not match the
|
|
# version declared in pyproject.toml, so a mistyped tag cannot ship the wrong version.
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
package_name:
|
|
# informational, used only in log output
|
|
required: true
|
|
type: string
|
|
use_private_index:
|
|
# build backends that need the in-house BB* packages to resolve build dependencies
|
|
type: boolean
|
|
default: false
|
|
secrets:
|
|
REGISTRY_USERNAME: { required: true }
|
|
REGISTRY_PASSWORD: { required: true }
|
|
PYPI_UPLOAD_URL: { required: true }
|
|
PYPI_UPLOAD_USER: { required: true }
|
|
PYPI_UPLOAD_PASSWORD: { required: true }
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: docker
|
|
container:
|
|
image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
|
|
credentials:
|
|
username: ${{ secrets.REGISTRY_USERNAME }}
|
|
password: ${{ secrets.REGISTRY_PASSWORD }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Configure private package index
|
|
if: ${{ inputs.use_private_index }}
|
|
env:
|
|
PRIVATE_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
|
|
run: |
|
|
if [ -z "$PRIVATE_INDEX_URL" ]; then
|
|
echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
|
|
exit 1
|
|
fi
|
|
pip config --site set global.extra-index-url "$PRIVATE_INDEX_URL"
|
|
|
|
- name: Verify the tag matches the package version
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if ! echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
|
|
echo "This workflow only publishes on version tags (refs/tags/v*), got '${{ gitea.ref }}'"
|
|
exit 1
|
|
fi
|
|
|
|
TAG_VERSION="${{ gitea.ref_name }}"
|
|
TAG_VERSION="${TAG_VERSION#v}"
|
|
PROJECT_VERSION="$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
|
|
|
|
echo "tag version : ${TAG_VERSION}"
|
|
echo "pyproject version: ${PROJECT_VERSION}"
|
|
|
|
if [ "${TAG_VERSION}" != "${PROJECT_VERSION}" ]; then
|
|
echo "Tag v${TAG_VERSION} does not match the version ${PROJECT_VERSION} in pyproject.toml"
|
|
echo "Bump the version in pyproject.toml and retag, so the published artifact matches the tag."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Build the package
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
python -m pip install --upgrade pip build twine
|
|
python -m build
|
|
echo "=== built artifacts for ${{ inputs.package_name }} ==="
|
|
ls -1 dist
|
|
|
|
- name: Check the artifacts
|
|
run: python -m twine check dist/*
|
|
|
|
- name: Upload to the package registry
|
|
env:
|
|
TWINE_USERNAME: ${{ secrets.PYPI_UPLOAD_USER }}
|
|
TWINE_PASSWORD: ${{ secrets.PYPI_UPLOAD_PASSWORD }}
|
|
run: |
|
|
python -m twine upload --repository-url "${{ secrets.PYPI_UPLOAD_URL }}" dist/*
|