fix(ci): require main-branch release tags #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| PIP_DISABLE_PIP_VERSION_CHECK: "1" | |
| PYTHONUNBUFFERED: "1" | |
| jobs: | |
| test: | |
| name: Test Python ${{ matrix.python-version }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| cache-dependency-path: pyproject.toml | |
| - name: Install package and development tools | |
| run: python -m pip install -e '.[dev]' | |
| - name: Run tests | |
| run: python -m pytest -q | |
| quality: | |
| name: Quality | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 | |
| with: | |
| python-version: "3.14" | |
| cache: pip | |
| cache-dependency-path: pyproject.toml | |
| - name: Install package and development tools | |
| run: python -m pip install -e '.[dev]' | |
| - name: Check formatting | |
| run: python -m ruff format --check src tests examples | |
| - name: Lint | |
| run: python -m ruff check src tests examples | |
| - name: Type check | |
| run: python -m mypy src/createos --ignore-missing-imports | |
| - name: Check test coverage | |
| run: >- | |
| python -m pytest | |
| --cov=createos | |
| --cov-report=term-missing | |
| --cov-fail-under=70 | |
| package: | |
| name: Package | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 | |
| with: | |
| python-version: "3.14" | |
| cache: pip | |
| cache-dependency-path: pyproject.toml | |
| - name: Install package and development tools | |
| run: python -m pip install -e '.[dev]' | |
| - name: Build source and wheel distributions | |
| run: python -m build | |
| - name: Check distributions | |
| run: python -m twine check --strict dist/* | |
| - name: Install and import the built wheel | |
| run: | | |
| python -m pip install --force-reinstall dist/*.whl | |
| python -c "import createos; print(createos.__version__)" | |
| - if: startsWith(github.ref, 'refs/tags/') | |
| name: Verify tag matches package version | |
| run: | | |
| if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then | |
| echo "release tag must point to a commit on main" >&2 | |
| exit 1 | |
| fi | |
| version=$(python -c "import re,pathlib;print(re.search(r'\"(.+)\"',pathlib.Path('src/createos/_version.py').read_text()).group(1))") | |
| tag="${GITHUB_REF_NAME#v}" | |
| if [ "$version" != "$tag" ]; then | |
| echo "tag v$tag does not match _version.py ($version)" >&2 | |
| exit 1 | |
| fi | |
| - if: startsWith(github.ref, 'refs/tags/') | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: dist | |
| path: dist/ | |
| publish: | |
| name: Publish to PyPI | |
| needs: [test, quality, package] | |
| if: startsWith(github.ref, 'refs/tags/') | |
| runs-on: ubuntu-latest | |
| environment: pypi | |
| permissions: | |
| id-token: write | |
| steps: | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: dist | |
| path: dist/ | |
| - name: Publish to PyPI | |
| uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 |