Repository navigation
Merge pull request #115 from NDDev-OpenNetwork/release/0.0.69 #15
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: publish-pypi | |
| # A second way to reach the same bytes. The release is the trusted path; this | |
| # is convenience, and it says so in the package metadata. | |
| # | |
| # All seven projects and their trusted publishers exist. The ordinary path | |
| # starts from the same immutable tag as the release workflow; workflow_dispatch | |
| # is only recovery for a release whose follow-up did not run. | |
| on: | |
| push: | |
| tags: | |
| - '[0-9]+.[0-9]+.[0-9]+' | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: existing release tag to backfill | |
| required: true | |
| type: string | |
| permissions: {} | |
| # One publication at a time per tag. A second run of the same tag would build | |
| # the same wheels and meet PyPI's refusal to overwrite a file, which is the | |
| # right refusal in the wrong place: better to queue than to race. | |
| concurrency: | |
| group: publish-pypi-${{ inputs.tag || github.ref_name }} | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| name: wheels | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| # The environment the pending publisher names. Trusted publishing binds | |
| # the exchange to it, so a workflow that forgets it is refused by PyPI | |
| # rather than publishing from an unexpected place. | |
| environment: pypi | |
| permissions: | |
| contents: read # read the repository and this tag's release assets; nothing here writes | |
| id-token: write # the OIDC token PyPI exchanges for a short-lived upload right bound to this repository, workflow and environment | |
| steps: | |
| - name: Check out exact source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - name: Take the release assets this tag published | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TAG: ${{ inputs.tag || github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| # The release workflow starts from the same tag. It may finish after | |
| # this job reaches the download, so wait for the complete seven-file | |
| # release rather than racing it or accepting a partial upload. | |
| for attempt in $(seq 1 40); do | |
| rm -rf assets | |
| mkdir -p assets | |
| if gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --dir assets 2>/dev/null && test "$(find assets -type f | wc -l)" -eq 7; then | |
| break | |
| fi | |
| if [ "$attempt" -eq 40 ]; then | |
| echo "release $TAG did not publish seven assets within 20 minutes" >&2 | |
| exit 1 | |
| fi | |
| sleep 30 | |
| done | |
| # Six binaries and a checksum file, or the release is not one this | |
| # can pack. Named here rather than discovered, so a partial release | |
| # stops the job instead of publishing five platforms out of six. | |
| test "$(find assets -type f | wc -l)" -eq 7 | |
| - name: The bytes must be the ones the release signed for | |
| run: | | |
| set -euo pipefail | |
| cd assets | |
| sha256sum --check --ignore-missing SHA256SUMS | |
| - name: Build one wheel per platform | |
| env: | |
| TAG: ${{ inputs.tag || github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| python3 tools/build_wheels.py --self-check | |
| python3 tools/build_wheels.py --harness opencode --version "$TAG" --assets assets --out dist | |
| ls -l dist | |
| - name: Publish to PyPI as opencode-setup-system | |
| uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 | |
| with: | |
| # Attestations are what make this channel checkable at all: PyPI | |
| # keeps a PEP 740 bundle naming this repository, this workflow and | |
| # this environment, which is the same triple the GitHub path proves | |
| # a different way. | |
| attestations: true |