Seal prepared request capabilities for v0.4.4 (#29) #12

	name: release

	on:
	push:
	tags:
	- "v*"

	permissions:
	contents: write
	id-token: write
	attestations: write

	jobs:
	python-distribution:
	environment: release
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	fetch-depth: 0
	- name: Verify signed annotated release tag
	shell: bash
	run: \|
	test "$(git cat-file -t "$GITHUB_REF_NAME")" = tag
	git config gpg.format ssh
	git config gpg.ssh.allowedSignersFile "$GITHUB_WORKSPACE/.github/release-signers"
	git verify-tag "$GITHUB_REF_NAME"
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
	with:
	python-version: "3.13"
	- name: Verify tag matches package version
	run: python -c "import os; from mrma import __version__; expected=os.environ['GITHUB_REF_NAME'].removeprefix('v'); assert __version__ == expected, f'{__version__} != {expected}'"
	- run: python -m pip install --upgrade pip twine
	- name: Install hash-locked build toolchain
	run: >-
	python -m pip install --only-binary=:all:
	--require-hashes -r requirements-build.txt
	- run: python -m build --no-isolation
	- run: python -m twine check dist/*
	- uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 # v3
	with:
	subject-path: dist/*
	- name: Create GitHub release with Python distributions
	env:
	GH_TOKEN: ${{ github.token }}
	run: gh release create "$GITHUB_REF_NAME" dist/* --verify-tag --generate-notes --title "MRMA $GITHUB_REF_NAME"

Navigation Menu