shieldlabs-python/.github/workflows/release.yml at main · ShieldLabs-ai/shieldlabs-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: Release

# Publishes the package to PyPI when a version tag (v1.0.0, v1.0.1, ...) is pushed.
# The build job has read-only access. The publish job only receives the built files and uses
# PyPI trusted publishing (OpenID Connect), so no API token is stored in the repository.
# One-time setup: on PyPI, add this repository, the workflow file release.yml and the
# environment "pypi" as a trusted publisher of the "shieldlabs" project.
# Re-running the workflow for the same tag is safe: files already on PyPI are skipped.

on:
  push:
    tags: ["v*"]

permissions:
  contents: read

jobs:
  build:
    name: Check and build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"
      - name: Install
        run: python -m pip install -e ".[dev]" build==1.6.1 twine==7.0.0
      - name: Check that the tag matches the package version
        run: |
          version="$(python -c 'import shieldlabs; print(shieldlabs.__version__)')"
          if [ "v${version}" != "${GITHUB_REF_NAME}" ]; then
            echo "::error::Tag ${GITHUB_REF_NAME} does not match the package version ${version}."
            exit 1
          fi
      - name: Verify
        run: |
          ruff check .
          ruff format --check .
          mypy --strict src
          pytest -q
      - name: Build
        run: |
          python -m build
          twine check --strict dist/*
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  publish:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/shieldlabs/
    permissions:
      id-token: write # trusted publishing and attestations
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          skip-existing: true
          attestations: true