From 5c419bfecea76f68869c8b906e4d3cb65bdf743e Mon Sep 17 00:00:00 2001 From: boronine-bot Date: Tue, 20 Oct 2026 15:22:17 +0000 Subject: [PATCH 1/7] Prepare OIDC-based PyPI pre-release publishing --- .github/workflows/publish-prerelease.yml | 103 +++++++++++++++++++++++ README.md | 4 + RELEASING.md | 72 ++++++++++++++++ 3 files changed, 179 insertions(+) create mode 100644 .github/workflows/publish-prerelease.yml create mode 100644 RELEASING.md diff --git a/.github/workflows/publish-prerelease.yml b/.github/workflows/publish-prerelease.yml new file mode 100644 index 0000000..678e546 --- /dev/null +++ b/.github/workflows/publish-prerelease.yml @@ -0,0 +1,103 @@ +name: Publish a pre-release to PyPI + +on: + workflow_dispatch: + inputs: + tag: + description: 'Existing pre-release tag matching hsluv.__version__ (for example v5.0.5rc1)' + required: true + type: string + +permissions: + contents: read + +concurrency: + group: pypi-prerelease + cancel-in-progress: false + +jobs: + build: + if: github.repository == 'hsluv/hsluv-python' && github.ref == 'refs/heads/master' + runs-on: ubuntu-24.04 + strategy: + matrix: + python-version: ['3.11', '3.15'] + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: refs/tags/${{ inputs.tag }} + fetch-depth: 0 + persist-credentials: false + + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: ${{ matrix.python-version }} + + - name: Install build tools + run: python -m pip install build packaging twine + + - name: Require a matching pre-release tag on master + env: + RELEASE_TAG: ${{ inputs.tag }} + run: | + git merge-base --is-ancestor HEAD origin/master + python - <<'PY' + import ast + import os + from pathlib import Path + from packaging.version import Version + + module = ast.parse(Path('hsluv.py').read_text()) + version_text = next( + ast.literal_eval(node.value) + for node in module.body + if isinstance(node, ast.Assign) + and any(isinstance(target, ast.Name) and target.id == '__version__' + for target in node.targets) + ) + version = Version(version_text) + if not version.is_prerelease or version.is_devrelease or version.local is not None: + raise SystemExit('Only alpha, beta, or release-candidate versions may be published.') + if os.environ['RELEASE_TAG'] != f'v{version_text}': + raise SystemExit('The tag must exactly match v.') + print(f'Validated pre-release {version_text}') + PY + + - name: Build and check distributions + run: | + python -m build + python -m twine check --strict dist/* + + - name: Test installed source distribution and wheel + run: | + python -m pip install dist/*.tar.gz + cd "$(mktemp -d)" + python -m unittest discover -s "$GITHUB_WORKSPACE/tests" -v + python -m pip install --force-reinstall "$GITHUB_WORKSPACE"/dist/*.whl + python -m unittest discover -s "$GITHUB_WORKSPACE/tests" -v + python -c 'import hsluv; from importlib.metadata import version; assert hsluv.__version__ == version("hsluv")' + + - name: Save distributions for publishing + if: matrix.python-version == '3.11' + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: pypi-distributions + path: dist/* + if-no-files-found: error + + publish: + needs: build + runs-on: ubuntu-24.04 + environment: + name: pypi + url: https://pypi.org/project/hsluv/ + permissions: + id-token: write + steps: + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + with: + name: pypi-distributions + path: dist/ + + - name: Publish to PyPI using Trusted Publishing + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 diff --git a/README.md b/README.md index e77f608..5a0728e 100644 --- a/README.md +++ b/README.md @@ -40,6 +40,10 @@ For HPLuv (the pastel variant), use `hpluv_to_hex`, `hpluv_to_rgb`, `hex_to_hplu Run `python -m unittest discover -v`. +## Releasing + +See [RELEASING.md](RELEASING.md) for PyPI Trusted Publishing setup and pre-release instructions. + ## Authors * Robert McGinley ([mcginleyr1](https://github.com/mcginleyr1)) diff --git a/RELEASING.md b/RELEASING.md new file mode 100644 index 0000000..7910e06 --- /dev/null +++ b/RELEASING.md @@ -0,0 +1,72 @@ +# Publishing pre-releases to PyPI + +Publishing uses [PyPI Trusted Publishing](https://docs.pypi.org/trusted-publishers/) +(GitHub Actions OIDC), not a stored PyPI password or API token. +This setup does not create releases or change the package version. + +## One-time setup for Alexei + +1. Merge the workflow into `master`. +2. In the **hsluv/hsluv-python** GitHub repository, open **Settings → Environments** + and create an environment named **`pypi`**. + - Add Alexei (`boronine`) as a required reviewer. Add other trusted release + maintainers if desired. Approval is required before the upload job starts. + - Under deployment branches and tags, select **Selected branches and tags** + and allow the **branch `master`** only. The workflow is dispatched from + `master`; its build job separately checks out the requested tag. + - If GitHub does not offer required reviewers under the repository's plan, + do not assume that the workflow itself provides an approval gate. Resolve + that limitation before enabling publishing. +3. As an owner of the existing `hsluv` project on PyPI, open + and add a + **GitHub** trusted publisher with exactly these values: + + | Field | Value | + | --- | --- | + | Owner | `hsluv` | + | Repository name | `hsluv-python` | + | Workflow name (filename, not display name) | `publish-prerelease.yml` | + | Environment name | `pypi` | + + Register against the **existing project**, not as a pending publisher. + See [PyPI's setup instructions](https://docs.pypi.org/trusted-publishers/adding-a-publisher/). +4. Do not add `PYPI_API_TOKEN`, a password, or other PyPI secrets to GitHub. + Only the isolated upload job receives `id-token: write`; it downloads the + tested artifacts and does not check out or execute the package source. + +**Stop here for the setup PR.** Do not bump the version, create a tag, dispatch +the workflow, or approve a deployment yet. Those steps belong to a follow-up. + +## Publishing later, after a separate release-preparation PR + +1. Choose an unused alpha, beta, or release-candidate version, such as + `5.0.5rc1` (**example only**, not a version selected by this setup). + Update `hsluv.__version__`, merge that change into `master`, and ensure CI passes. +2. Create and push a tag on that reviewed commit, named exactly `v` followed by + the version (for example, `v5.0.5rc1`). The tag must point to a commit in + `master`'s history. Protect release tags against modification/deletion using + repository rules where available. +3. Open **Actions → Publish a pre-release to PyPI → Run workflow**. Select + **`master`** as the workflow branch and enter the existing tag as **tag**. + Creating a tag or a GitHub release alone does **not** trigger publication. +4. The workflow rejects stable, development, local, or mismatched versions, + builds both distributions, checks their metadata, and tests installation of + the source archive and wheel on Python 3.11 and 3.15. +5. Review the workflow run, tag/commit, and build artifacts. Approve the **`pypi`** + deployment only when ready: approval publishes to **production PyPI**, not + TestPyPI. OIDC setup or environment configuration errors must be fixed before + approving a new attempt; do not work around them by adding a long-lived token. +6. Confirm the version and files at . Test with + `python -m pip install --pre hsluv` in a clean environment (or pin the exact + version). Ordinary installs generally do not select pre-releases when a + satisfactory stable release exists. + +PyPI does not let you overwrite an uploaded filename. If a published artifact +needs correction, prepare a new pre-release version instead of moving the tag +or rebuilding the same version. This workflow intentionally does not skip +already-uploaded files. + +## Stable releases + +Stable publication is intentionally unsupported by this workflow. Enabling it +requires a separately reviewed change; do not bypass the pre-release checks. From 54308c1336a3a7dcb366586226baa749a7a1e36b Mon Sep 17 00:00:00 2001 From: boronine-bot Date: Wed, 21 Oct 2026 11:14:20 +0000 Subject: [PATCH 2/7] Use main for publishing and document individual PyPI ownership --- .github/workflows/publish-prerelease.yml | 6 ++-- RELEASING.md | 44 +++++++++++++++++++----- 2 files changed, 39 insertions(+), 11 deletions(-) diff --git a/.github/workflows/publish-prerelease.yml b/.github/workflows/publish-prerelease.yml index 678e546..e2877c8 100644 --- a/.github/workflows/publish-prerelease.yml +++ b/.github/workflows/publish-prerelease.yml @@ -17,7 +17,7 @@ concurrency: jobs: build: - if: github.repository == 'hsluv/hsluv-python' && github.ref == 'refs/heads/master' + if: github.repository == 'hsluv/hsluv-python' && github.ref == 'refs/heads/main' runs-on: ubuntu-24.04 strategy: matrix: @@ -36,11 +36,11 @@ jobs: - name: Install build tools run: python -m pip install build packaging twine - - name: Require a matching pre-release tag on master + - name: Require a matching pre-release tag on main env: RELEASE_TAG: ${{ inputs.tag }} run: | - git merge-base --is-ancestor HEAD origin/master + git merge-base --is-ancestor HEAD origin/main python - <<'PY' import ast import os diff --git a/RELEASING.md b/RELEASING.md index 7910e06..4f9c0e2 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -6,34 +6,62 @@ This setup does not create releases or change the package version. ## One-time setup for Alexei -1. Merge the workflow into `master`. +First complete the access checks in [issue #84](https://github.com/hsluv/hsluv-python/issues/84): +sign in to PyPI using your individual **`boronine`** account and verify that it +has the **Owner** role on the existing `hsluv` project. If needed, have a current +Owner invite it, accept the invitation, and verify access before removing any +existing access. Each human maintainer should use their own account with 2FA +and securely stored recovery codes; consider a second trusted individual Owner +for continuity. + +Do not share the login for an ordinary PyPI user account named `hsluv`. +[PyPI's terms prohibit shared logins](https://policies.python.org/pypi.org/Terms-of-Service/#3-account-requirements). +A genuine [community PyPI organization](https://docs.pypi.org/organization-accounts/) +is an optional way to manage the project and individual members, not a +prerequisite for Trusted Publishing. Confirm the existing account's type before +changing it. Do not delete or recreate the package, or delete an old account +before checking all its projects and access dependencies. + +1. Merge the workflow into `main`. 2. In the **hsluv/hsluv-python** GitHub repository, open **Settings → Environments** and create an environment named **`pypi`**. - Add Alexei (`boronine`) as a required reviewer. Add other trusted release maintainers if desired. Approval is required before the upload job starts. - Under deployment branches and tags, select **Selected branches and tags** - and allow the **branch `master`** only. The workflow is dispatched from - `master`; its build job separately checks out the requested tag. + and allow the **branch `main`** only. If an existing rule still names + `master`, replace it with `main` while keeping required reviewers. + The workflow is dispatched from `main`; its build job separately checks + out the requested tag. - If GitHub does not offer required reviewers under the repository's plan, do not assume that the workflow itself provides an approval gate. Resolve that limitation before enabling publishing. -3. As an owner of the existing `hsluv` project on PyPI, open +3. While signed in to PyPI as **`boronine`**, an Owner of the existing `hsluv` + project, open and add a **GitHub** trusted publisher with exactly these values: | Field | Value | | --- | --- | - | Owner | `hsluv` | + | Owner (GitHub repository owner) | `hsluv` | | Repository name | `hsluv-python` | | Workflow name (filename, not display name) | `publish-prerelease.yml` | | Environment name | `pypi` | Register against the **existing project**, not as a pending publisher. + Here `hsluv` identifies the **GitHub organization**, not the PyPI account + used to log in. Future uploads authenticate as the trusted workflow, not as + `boronine` or a shared `hsluv` login. See [PyPI's setup instructions](https://docs.pypi.org/trusted-publishers/adding-a-publisher/). 4. Do not add `PYPI_API_TOKEN`, a password, or other PyPI secrets to GitHub. Only the isolated upload job receives `id-token: write`; it downloads the tested artifacts and does not check out or execute the package source. +After individual-owner access and the publishing setup have been verified, +retire any shared-login arrangement and revoke obsolete CI tokens once their +replacement is confirmed working, as tracked in issue #84. An organization +transfer, if desired, is a separate administration step; it does not require +changing the package name, authors, or license. + **Stop here for the setup PR.** Do not bump the version, create a tag, dispatch the workflow, or approve a deployment yet. Those steps belong to a follow-up. @@ -41,13 +69,13 @@ the workflow, or approve a deployment yet. Those steps belong to a follow-up. 1. Choose an unused alpha, beta, or release-candidate version, such as `5.0.5rc1` (**example only**, not a version selected by this setup). - Update `hsluv.__version__`, merge that change into `master`, and ensure CI passes. + Update `hsluv.__version__`, merge that change into `main`, and ensure CI passes. 2. Create and push a tag on that reviewed commit, named exactly `v` followed by the version (for example, `v5.0.5rc1`). The tag must point to a commit in - `master`'s history. Protect release tags against modification/deletion using + `main`'s history. Protect release tags against modification/deletion using repository rules where available. 3. Open **Actions → Publish a pre-release to PyPI → Run workflow**. Select - **`master`** as the workflow branch and enter the existing tag as **tag**. + **`main`** as the workflow branch and enter the existing tag as **tag**. Creating a tag or a GitHub release alone does **not** trigger publication. 4. The workflow rejects stable, development, local, or mismatched versions, builds both distributions, checks their metadata, and tests installation of From 72c5ba224303d78c3e593c1826de08415645a0a1 Mon Sep 17 00:00:00 2001 From: boronine-bot Date: Wed, 21 Oct 2026 20:42:56 +0000 Subject: [PATCH 3/7] Publish current pre-release version without tag input or added docs --- .github/workflows/publish-prerelease.yml | 15 +--- README.md | 4 - RELEASING.md | 100 ----------------------- 3 files changed, 1 insertion(+), 118 deletions(-) delete mode 100644 RELEASING.md diff --git a/.github/workflows/publish-prerelease.yml b/.github/workflows/publish-prerelease.yml index e2877c8..1ff428f 100644 --- a/.github/workflows/publish-prerelease.yml +++ b/.github/workflows/publish-prerelease.yml @@ -2,11 +2,6 @@ name: Publish a pre-release to PyPI on: workflow_dispatch: - inputs: - tag: - description: 'Existing pre-release tag matching hsluv.__version__ (for example v5.0.5rc1)' - required: true - type: string permissions: contents: read @@ -25,8 +20,6 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: refs/tags/${{ inputs.tag }} - fetch-depth: 0 persist-credentials: false - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 @@ -36,14 +29,10 @@ jobs: - name: Install build tools run: python -m pip install build packaging twine - - name: Require a matching pre-release tag on main - env: - RELEASE_TAG: ${{ inputs.tag }} + - name: Require a pre-release version run: | - git merge-base --is-ancestor HEAD origin/main python - <<'PY' import ast - import os from pathlib import Path from packaging.version import Version @@ -58,8 +47,6 @@ jobs: version = Version(version_text) if not version.is_prerelease or version.is_devrelease or version.local is not None: raise SystemExit('Only alpha, beta, or release-candidate versions may be published.') - if os.environ['RELEASE_TAG'] != f'v{version_text}': - raise SystemExit('The tag must exactly match v.') print(f'Validated pre-release {version_text}') PY diff --git a/README.md b/README.md index 161a2aa..93667f4 100644 --- a/README.md +++ b/README.md @@ -40,10 +40,6 @@ For HPLuv (the pastel variant), use `hpluv_to_hex`, `hpluv_to_rgb`, `hex_to_hplu Run `python -m unittest discover -v`. -## Releasing - -See [RELEASING.md](RELEASING.md) for PyPI Trusted Publishing setup and pre-release instructions. - ## Authors * Robert McGinley ([mcginleyr1](https://github.com/mcginleyr1)) diff --git a/RELEASING.md b/RELEASING.md deleted file mode 100644 index 4f9c0e2..0000000 --- a/RELEASING.md +++ /dev/null @@ -1,100 +0,0 @@ -# Publishing pre-releases to PyPI - -Publishing uses [PyPI Trusted Publishing](https://docs.pypi.org/trusted-publishers/) -(GitHub Actions OIDC), not a stored PyPI password or API token. -This setup does not create releases or change the package version. - -## One-time setup for Alexei - -First complete the access checks in [issue #84](https://github.com/hsluv/hsluv-python/issues/84): -sign in to PyPI using your individual **`boronine`** account and verify that it -has the **Owner** role on the existing `hsluv` project. If needed, have a current -Owner invite it, accept the invitation, and verify access before removing any -existing access. Each human maintainer should use their own account with 2FA -and securely stored recovery codes; consider a second trusted individual Owner -for continuity. - -Do not share the login for an ordinary PyPI user account named `hsluv`. -[PyPI's terms prohibit shared logins](https://policies.python.org/pypi.org/Terms-of-Service/#3-account-requirements). -A genuine [community PyPI organization](https://docs.pypi.org/organization-accounts/) -is an optional way to manage the project and individual members, not a -prerequisite for Trusted Publishing. Confirm the existing account's type before -changing it. Do not delete or recreate the package, or delete an old account -before checking all its projects and access dependencies. - -1. Merge the workflow into `main`. -2. In the **hsluv/hsluv-python** GitHub repository, open **Settings → Environments** - and create an environment named **`pypi`**. - - Add Alexei (`boronine`) as a required reviewer. Add other trusted release - maintainers if desired. Approval is required before the upload job starts. - - Under deployment branches and tags, select **Selected branches and tags** - and allow the **branch `main`** only. If an existing rule still names - `master`, replace it with `main` while keeping required reviewers. - The workflow is dispatched from `main`; its build job separately checks - out the requested tag. - - If GitHub does not offer required reviewers under the repository's plan, - do not assume that the workflow itself provides an approval gate. Resolve - that limitation before enabling publishing. -3. While signed in to PyPI as **`boronine`**, an Owner of the existing `hsluv` - project, open - and add a - **GitHub** trusted publisher with exactly these values: - - | Field | Value | - | --- | --- | - | Owner (GitHub repository owner) | `hsluv` | - | Repository name | `hsluv-python` | - | Workflow name (filename, not display name) | `publish-prerelease.yml` | - | Environment name | `pypi` | - - Register against the **existing project**, not as a pending publisher. - Here `hsluv` identifies the **GitHub organization**, not the PyPI account - used to log in. Future uploads authenticate as the trusted workflow, not as - `boronine` or a shared `hsluv` login. - See [PyPI's setup instructions](https://docs.pypi.org/trusted-publishers/adding-a-publisher/). -4. Do not add `PYPI_API_TOKEN`, a password, or other PyPI secrets to GitHub. - Only the isolated upload job receives `id-token: write`; it downloads the - tested artifacts and does not check out or execute the package source. - -After individual-owner access and the publishing setup have been verified, -retire any shared-login arrangement and revoke obsolete CI tokens once their -replacement is confirmed working, as tracked in issue #84. An organization -transfer, if desired, is a separate administration step; it does not require -changing the package name, authors, or license. - -**Stop here for the setup PR.** Do not bump the version, create a tag, dispatch -the workflow, or approve a deployment yet. Those steps belong to a follow-up. - -## Publishing later, after a separate release-preparation PR - -1. Choose an unused alpha, beta, or release-candidate version, such as - `5.0.5rc1` (**example only**, not a version selected by this setup). - Update `hsluv.__version__`, merge that change into `main`, and ensure CI passes. -2. Create and push a tag on that reviewed commit, named exactly `v` followed by - the version (for example, `v5.0.5rc1`). The tag must point to a commit in - `main`'s history. Protect release tags against modification/deletion using - repository rules where available. -3. Open **Actions → Publish a pre-release to PyPI → Run workflow**. Select - **`main`** as the workflow branch and enter the existing tag as **tag**. - Creating a tag or a GitHub release alone does **not** trigger publication. -4. The workflow rejects stable, development, local, or mismatched versions, - builds both distributions, checks their metadata, and tests installation of - the source archive and wheel on Python 3.11 and 3.15. -5. Review the workflow run, tag/commit, and build artifacts. Approve the **`pypi`** - deployment only when ready: approval publishes to **production PyPI**, not - TestPyPI. OIDC setup or environment configuration errors must be fixed before - approving a new attempt; do not work around them by adding a long-lived token. -6. Confirm the version and files at . Test with - `python -m pip install --pre hsluv` in a clean environment (or pin the exact - version). Ordinary installs generally do not select pre-releases when a - satisfactory stable release exists. - -PyPI does not let you overwrite an uploaded filename. If a published artifact -needs correction, prepare a new pre-release version instead of moving the tag -or rebuilding the same version. This workflow intentionally does not skip -already-uploaded files. - -## Stable releases - -Stable publication is intentionally unsupported by this workflow. Enabling it -requires a separately reviewed change; do not bypass the pre-release checks. From 3bbee85210cb8033e8228050929b74beadad6125 Mon Sep 17 00:00:00 2001 From: boronine-bot Date: Wed, 21 Oct 2026 20:45:58 +0000 Subject: [PATCH 4/7] Simplify pre-release publishing to a single job --- .github/workflows/publish-prerelease.yml | 84 ++++-------------------- 1 file changed, 14 insertions(+), 70 deletions(-) diff --git a/.github/workflows/publish-prerelease.yml b/.github/workflows/publish-prerelease.yml index 1ff428f..e3df248 100644 --- a/.github/workflows/publish-prerelease.yml +++ b/.github/workflows/publish-prerelease.yml @@ -1,90 +1,34 @@ name: Publish a pre-release to PyPI - -on: - workflow_dispatch: - +on: workflow_dispatch permissions: contents: read - -concurrency: - group: pypi-prerelease - cancel-in-progress: false +concurrency: pypi-prerelease jobs: - build: + publish: if: github.repository == 'hsluv/hsluv-python' && github.ref == 'refs/heads/main' runs-on: ubuntu-24.04 - strategy: - matrix: - python-version: ['3.11', '3.15'] + environment: pypi + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: - python-version: ${{ matrix.python-version }} - - - name: Install build tools - run: python -m pip install build packaging twine - - - name: Require a pre-release version + python-version: '3.11' + - run: python -m pip install build packaging twine + - name: Check pre-release version and build run: | python - <<'PY' - import ast - from pathlib import Path + import hsluv from packaging.version import Version - - module = ast.parse(Path('hsluv.py').read_text()) - version_text = next( - ast.literal_eval(node.value) - for node in module.body - if isinstance(node, ast.Assign) - and any(isinstance(target, ast.Name) and target.id == '__version__' - for target in node.targets) - ) - version = Version(version_text) - if not version.is_prerelease or version.is_devrelease or version.local is not None: + v = Version(hsluv.__version__) + if not v.pre or v.dev is not None or v.local is not None: raise SystemExit('Only alpha, beta, or release-candidate versions may be published.') - print(f'Validated pre-release {version_text}') PY - - - name: Build and check distributions - run: | python -m build python -m twine check --strict dist/* - - - name: Test installed source distribution and wheel - run: | - python -m pip install dist/*.tar.gz - cd "$(mktemp -d)" - python -m unittest discover -s "$GITHUB_WORKSPACE/tests" -v - python -m pip install --force-reinstall "$GITHUB_WORKSPACE"/dist/*.whl - python -m unittest discover -s "$GITHUB_WORKSPACE/tests" -v - python -c 'import hsluv; from importlib.metadata import version; assert hsluv.__version__ == version("hsluv")' - - - name: Save distributions for publishing - if: matrix.python-version == '3.11' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: pypi-distributions - path: dist/* - if-no-files-found: error - - publish: - needs: build - runs-on: ubuntu-24.04 - environment: - name: pypi - url: https://pypi.org/project/hsluv/ - permissions: - id-token: write - steps: - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 - with: - name: pypi-distributions - path: dist/ - - - name: Publish to PyPI using Trusted Publishing - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 + - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 From 188f96525bd0025a14a5632ba9e511639d24eb81 Mon Sep 17 00:00:00 2001 From: boronine-bot Date: Wed, 21 Oct 2026 20:53:32 +0000 Subject: [PATCH 5/7] Make PyPI publishing workflow support all releases --- .../{publish-prerelease.yml => publish.yml} | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) rename .github/workflows/{publish-prerelease.yml => publish.yml} (59%) diff --git a/.github/workflows/publish-prerelease.yml b/.github/workflows/publish.yml similarity index 59% rename from .github/workflows/publish-prerelease.yml rename to .github/workflows/publish.yml index e3df248..b2c583d 100644 --- a/.github/workflows/publish-prerelease.yml +++ b/.github/workflows/publish.yml @@ -1,8 +1,8 @@ -name: Publish a pre-release to PyPI +name: Publish to PyPI on: workflow_dispatch permissions: contents: read -concurrency: pypi-prerelease +concurrency: pypi-publish jobs: publish: @@ -19,16 +19,9 @@ jobs: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.11' - - run: python -m pip install build packaging twine - - name: Check pre-release version and build + - run: python -m pip install build twine + - name: Build and check distributions run: | - python - <<'PY' - import hsluv - from packaging.version import Version - v = Version(hsluv.__version__) - if not v.pre or v.dev is not None or v.local is not None: - raise SystemExit('Only alpha, beta, or release-candidate versions may be published.') - PY python -m build python -m twine check --strict dist/* - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 From dc2904a75f9e479c0f7412550d6ae35dd5d5f17b Mon Sep 17 00:00:00 2001 From: boronine-bot Date: Wed, 21 Oct 2026 20:57:03 +0000 Subject: [PATCH 6/7] Remove repository and branch guard from publishing workflow --- .github/workflows/publish.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index b2c583d..94ae99b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -6,7 +6,6 @@ concurrency: pypi-publish jobs: publish: - if: github.repository == 'hsluv/hsluv-python' && github.ref == 'refs/heads/main' runs-on: ubuntu-24.04 environment: pypi permissions: From fbd131ce827eabddaae34674aee8d82c6c56ef0b Mon Sep 17 00:00:00 2001 From: boronine-bot Date: Wed, 21 Oct 2026 20:58:58 +0000 Subject: [PATCH 7/7] Remove TestPyPI publishing workflow --- .github/workflows/testpypi.yml | 31 ------------------------------- 1 file changed, 31 deletions(-) delete mode 100644 .github/workflows/testpypi.yml diff --git a/.github/workflows/testpypi.yml b/.github/workflows/testpypi.yml deleted file mode 100644 index 767afff..0000000 --- a/.github/workflows/testpypi.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Publish to TestPyPI - -# Configure a TestPyPI Trusted Publisher for hsluv/hsluv-python, testpypi.yml, -# environment testpypi. Run from main with a version not already on TestPyPI. -on: - workflow_dispatch: - -permissions: - contents: read - id-token: write - -jobs: - publish: - if: github.repository == 'hsluv/hsluv-python' && github.ref == 'refs/heads/main' - runs-on: ubuntu-24.04 - environment: testpypi - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - with: - persist-credentials: false - - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 - with: - python-version: '3.11' - - - run: python -m pip install build - - run: python -m build - - - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 - with: - repository-url: https://test.pypi.org/legacy/