pytest/.github/workflows/deploy.yml at main · pytest-dev/pytest · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: deploy

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version'
        required: true
        default: '1.2.3'


# Set permissions at the job level.
permissions: {}

jobs:
  package:
    runs-on: ubuntu-latest
    env:
      SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTEST: ${{ github.event.inputs.version }}
    timeout-minutes: 10

    # Required by attest-build-provenance-github.
    permissions:
      id-token: write
      attestations: write

    steps:
    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        fetch-depth: 0
        persist-credentials: false

    - name: Build and Check Package
      uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5
      with:
        attest-build-provenance-github: 'true'

  generate-gh-release-notes:
    needs: [package]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        fetch-depth: 0
        persist-credentials: false

    - name: Set up tox
      uses: $/.github/actions/setup-tox
      with:
        python-version: "3.13"

    - name: Generate release notes
      env:
        VERSION: ${{ github.event.inputs.version }}
      run: |
        tox -e generate-gh-release-notes -- "$VERSION" gh-release-notes.md

    - name: Upload release notes
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: release-notes
        path: gh-release-notes.md
        retention-days: 1

  publish-to-pypi:
    if: github.repository == 'pytest-dev/pytest'
    # Need generate-gh-release-notes only for ordering.
    # Don't want to release to PyPI if generating GitHub release notes fails.
    needs: [package, generate-gh-release-notes]
    runs-on: ubuntu-latest
    environment: deploy
    timeout-minutes: 30
    permissions:
      id-token: write
    steps:
    - name: Download Package
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: Packages
        path: dist

    - name: Publish package to PyPI
      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33
      with:
        attestations: true

  push-tag:
    needs: [publish-to-pypi]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        fetch-depth: 0
        persist-credentials: true

    - name: Push tag
      env:
          VERSION: ${{ github.event.inputs.version }}
      run: |
        git config user.name "pytest bot"
        git config user.email "pytestbot@gmail.com"
        git tag --annotate --message=v"$VERSION" "$VERSION" ${{ github.sha }}
        git push origin "$VERSION"

  create-github-release:
    needs: [push-tag, generate-gh-release-notes]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
    - name: Download Package
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: Packages
        path: dist

    - name: Download release notes
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: release-notes
        path: .

    - name: Publish GitHub Release
      env:
        VERSION: ${{ github.event.inputs.version }}
        GH_REPO: ${{ github.repository }}
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        gh release create --notes-file gh-release-notes.md --verify-tag "$VERSION" dist/*