dscode/.github/workflows/publish-python.yml at main · dipankar/dscode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
name: Publish Python Package

# Builds and publishes Python wheels for dscode-core to PyPI.
# Uses maturin for building Rust-based Python packages.
# Triggered after a GitHub Release is published.
#
# Uses PyPI Trusted Publishing (OIDC) — no long-lived API tokens required.
#
# Prerequisites:
#   - Configure Trusted Publishing on PyPI:
#     https://pypi.org/manage/project/dscode-core/settings/publishing/
#     Add a new publisher: GitHub → dipankar/dscode → publish-python.yml

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to verify before publishing (e.g. 0.2.0)'
        required: false
        default: ''

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64
          - os: ubuntu-latest
            target: aarch64
          - os: macos-latest
            target: x86_64
          - os: macos-latest
            target: aarch64
          - os: windows-latest
            target: x86_64
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Verify version (if specified)
        if: github.event.inputs.version != ''
        run: |
          VERSION="${{ github.event.inputs.version }}"
          # Check Cargo.toml version
          CARGO_VERSION=$(grep '^version = ' crates/dscode-core/Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          if [ "$CARGO_VERSION" != "$VERSION" ]; then
            echo "Error: dscode-core Cargo version is $CARGO_VERSION, expected $VERSION"
            exit 1
          fi

      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          working-directory: crates/dscode-core/python
          target: ${{ matrix.target }}
          args: --release --out dist
          sccache: "true"

      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-${{ matrix.os }}-${{ matrix.target }}
          path: crates/dscode-core/python/dist

  publish:
    needs: build
    runs-on: ubuntu-latest
    if: github.event_name == 'release'
    environment: release
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: wheels-*
          path: dist
          merge-multiple: true

      - name: Publish to PyPI
        uses: PyO3/maturin-action@v1
        with:
          command: upload
          args: dist/*
        # No MATURIN_PYPI_TOKEN needed — Trusted Publishing uses OIDC automatically

  publish-dscode-wrapper:
    runs-on: ubuntu-latest
    if: github.event_name == 'release'
    environment: release
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Verify version (if specified)
        if: github.event.inputs.version != ''
        run: |
          VERSION="${{ github.event.inputs.version }}"
          PY_VERSION=$(grep '^version = ' packages/pypi/pyproject.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          if [ "$PY_VERSION" != "$VERSION" ]; then
            echo "Error: dscode-app PyPI version is $PY_VERSION, expected $VERSION"
            exit 1
          fi

      - name: Build sdist and wheel
        run: |
          pip install build
          cd packages/pypi
          python -m build

      - name: Publish dscode-app wrapper to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: packages/pypi/dist
          # Trusted Publishing (OIDC) — no API token needed