Initial open-source release #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publish to PyPI on a version tag (v*) via PyPI Trusted Publishing (OIDC) — no API token | |
| # stored anywhere. Before the first tag, register a pending publisher on pypi.org for project | |
| # `programsmith`, owner/repo `abundant-ai/ProgramSmith`, workflow `release.yml`, environment `pypi`. | |
| name: release | |
| on: | |
| push: | |
| tags: ["v*"] | |
| permissions: {} | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| build: | |
| name: Verify and build distributions | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.12" | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: "22" | |
| cache: "" # zizmor: ignore[cache-poisoning] release builds never restore mutable dependency caches | |
| - run: pip install -e ".[dev]" build twine check-wheel-contents | |
| - name: Verify tag matches package version | |
| run: | | |
| python - <<'PY' | |
| import os | |
| import tomllib | |
| from pathlib import Path | |
| version = tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"] | |
| expected = f"v{version}" | |
| actual = os.environ["GITHUB_REF_NAME"] | |
| if actual != expected: | |
| raise SystemExit(f"release tag {actual!r} must exactly match {expected!r}") | |
| PY | |
| - run: pytest | |
| - name: Verify committed frontend build | |
| working-directory: src/programsmith/ui/frontend | |
| run: | | |
| npm ci --no-audit | |
| npm run build | |
| git diff --exit-code -- dist/ | |
| - run: python -m build | |
| - run: python -m twine check dist/* | |
| - run: check-wheel-contents dist/*.whl | |
| - name: Smoke-test built wheel | |
| run: | | |
| python -m venv /tmp/programsmith-release-test | |
| /tmp/programsmith-release-test/bin/pip install dist/*.whl | |
| /tmp/programsmith-release-test/bin/programsmith --help | |
| /tmp/programsmith-release-test/bin/programsmith --version | |
| /tmp/programsmith-release-test/bin/psmith --help | |
| /tmp/programsmith-release-test/bin/psmith --version | |
| /tmp/programsmith-release-test/bin/python -m programsmith --help | |
| /tmp/programsmith-release-test/bin/python -m programsmith --version | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: dist | |
| path: dist/ | |
| retention-days: 7 | |
| publish: | |
| name: Publish to PyPI | |
| needs: build | |
| runs-on: ubuntu-latest | |
| environment: pypi # bind the OIDC exchange to a reviewable environment | |
| permissions: | |
| actions: read # download the verified build artifact from this workflow run | |
| id-token: write # PyPI trusted publishing (OIDC) | |
| steps: | |
| - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 | |
| with: | |
| name: dist | |
| path: dist/ | |
| - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 |