Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: update release workflow to follow pypa and pypi guidelines #73

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

lwasser
Copy link
Member

@lwasser lwasser commented Jan 8, 2025

this closes #48 We've been working with the pypa and pypi security folks on our blog post and this pr should address the suggested approaches to publishing using a release based workflow.

Because we are using a release, this assumes that tests are running on the main branch before a release is made. It also allows a dynamic maintainer team to make releases without the command line which is really nice.

NOTE: i haven't yet tested this specific file for issues. i'm not quite sure how - maybe via test pypi?

@@ -44,6 +44,22 @@ To use this template:
as your source. You can read more about generating your project
in the [copier documentation](https://copier.readthedocs.io/en/stable/generating/).

## How to run the test suite locally
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Friends, bare with me on the instructions. I'm still getting to know copier and am wrapping my head around the test suite works. it seems great as it caught some spacing issues in my workflow! I just don't fully understand it yet so if any of this isn't quite right please say the word!

@lwasser
Copy link
Member Author

lwasser commented Feb 6, 2025

i'd love review on this (but also see a merge conflict now that i just merged the other pr!! a few points of potential contention

  • maybe we do want tests to run before a release ? The path i've always taken is - submit a small pr with the changelog cleanup. if that passes, merge then create a release. Perhaps that is not as robust as the tests running on the release workflow itself.
  • I just learned that you can also assign an environment permissions. so pypa now suggests that you set credentials on the push to pypi step so a human has to approve the actual publish part.

id love your feedback here all @sneakers-the-rat @blink1073 @Midnighter i'd llike to get our template nailed down for spring workshops and then scipy if we get accepted!

environment:
name: pypi
# Modify the url to be the name of your package
url: https://pypi.org/p/yourPackage
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should be able to template this line, right?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you are right! I forgot about that. I still need to learn more about how this works with copier. i'll update the PR this week.

environment:
name: pypi
# Modify the url to be the name of your package
url: https://pypi.org/p/yourPackage
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
url: https://pypi.org/p/yourPackage
url: https://pypi.org/p/${{ github.ref_name }}

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually it might be as simple as this. i'll test locally 🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

request: release workflow on GitHub and follow PyPA and PyPI security recommendations
2 participants