From 10d62ac7c5e66d4fd4ddcc8fdc11f6f23f823ef3 Mon Sep 17 00:00:00 2001 From: Michka Popoff Date: Mon, 10 Mar 2025 20:54:53 +0100 Subject: [PATCH 1/7] ci: allow builds on master too --- .github/workflows/tests.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index f26babef..c6e69901 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -2,6 +2,7 @@ on: push: branches: - main + - master - develop pull_request: From 832d8625ae2c51ef03ad57d5c908b11b930dcb90 Mon Sep 17 00:00:00 2001 From: Michka Popoff Date: Tue, 11 Mar 2025 21:48:56 +0100 Subject: [PATCH 2/7] pyproject.toml: add readme This will display readme in pypi --- pyproject.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/pyproject.toml b/pyproject.toml index d3fe3dac..cf3faace 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -10,6 +10,7 @@ authors = [ {name = "Insight Software Consortium", email = "castxml@public.kitware.com"}, {name = "Roman Yakovenko", email = "romanyakovenko@gmail.com"}, ] +readme = "README.rst" license = {file = "LICENSE.rst"} keywords = [ "C++", From 01e964345f18a66501cdc5c897a66d1274580f18 Mon Sep 17 00:00:00 2001 From: Michka Popoff Date: Tue, 11 Mar 2025 21:50:24 +0100 Subject: [PATCH 3/7] ci: the main branch is called master --- .github/workflows/tests.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index f26babef..3c7a5963 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -1,7 +1,7 @@ on: push: branches: - - main + - master - develop pull_request: From 197350a7714689b1cbe81c2b5b3f274e3ac1e3d9 Mon Sep 17 00:00:00 2001 From: Michka Popoff Date: Tue, 11 Mar 2025 22:09:55 +0100 Subject: [PATCH 4/7] readme: remove codecov codecov has been removed --- README.rst | 3 --- 1 file changed, 3 deletions(-) diff --git a/README.rst b/README.rst index 0bfe4c7c..94be3365 100644 --- a/README.rst +++ b/README.rst @@ -1,9 +1,6 @@ pygccxml ======== -.. image:: https://codecov.io/gh/iMichka/pygccxml/branch/develop/graph/badge.svg - :target: https://codecov.io/gh/iMichka/pygccxml - :alt: Code coverage status .. image:: https://readthedocs.org/projects/pygccxml/badge/?version=develop :target: http://pygccxml.readthedocs.io/en/develop/?badge=develop :alt: Documentation status From 0fe0d8b3c6d8fe92dab9ab4132238bc7f9f7cffb Mon Sep 17 00:00:00 2001 From: Michka Popoff Date: Tue, 11 Mar 2025 22:17:08 +0100 Subject: [PATCH 5/7] ci: build releases in pypi Based on https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ Testing only the build part for the time being, pypi upload will come in a second step --- .github/workflows/tests.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index f26babef..1682b804 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -3,7 +3,10 @@ on: branches: - main - develop + release: + types: [created] pull_request: + workflow_dispatch: jobs: tests: @@ -241,3 +244,32 @@ jobs: run: | export PATH=~/castxml/bin:$PATH pytest tests + + build-release: + name: Build distribution 📦 + if: (github.event_name == 'release' && github.event.action == 'created') || (github.event_name == 'workflow_dispatch') + needs: tests + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: "3.x" + + - name: Install pypa/build + run: >- + python3 -m + pip install + build + --user + - name: Build a binary wheel and a source tarball + run: python3 -m build + - name: Store the distribution packages + uses: actions/upload-artifact@v4 + with: + name: python-package-distributions + path: dist/ From a4539df64c4aaf87d335797eec6ee484f263455b Mon Sep 17 00:00:00 2001 From: Michka Popoff Date: Tue, 11 Mar 2025 23:35:40 +0100 Subject: [PATCH 6/7] ci: publish to pypi and sign packages Based on https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ --- .github/workflows/tests.yml | 73 ++++++++++++++++++++++++++++++++++--- 1 file changed, 68 insertions(+), 5 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index db810552..09bb1016 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -3,10 +3,7 @@ on: branches: - master - develop - release: - types: [created] pull_request: - workflow_dispatch: jobs: tests: @@ -245,9 +242,9 @@ jobs: export PATH=~/castxml/bin:$PATH pytest tests - build-release: + build: name: Build distribution 📦 - if: (github.event_name == 'release' && github.event.action == 'created') || (github.event_name == 'workflow_dispatch') + if: startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes needs: tests runs-on: ubuntu-latest @@ -273,3 +270,69 @@ jobs: with: name: python-package-distributions path: dist/ + + publish-to-pypi: + name: >- + Publish Python 🐍 distribution 📦 to PyPI + if: startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes + needs: + - build + runs-on: ubuntu-latest + environment: + name: pypi + url: https://pypi.org/p/ # Replace with your PyPI project name + permissions: + id-token: write # IMPORTANT: mandatory for trusted publishing + + steps: + - name: Download all the dists + uses: actions/download-artifact@v4 + with: + name: python-package-distributions + path: dist/ + - name: Publish distribution 📦 to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 + + github-release: + name: >- + Sign the Python 🐍 distribution 📦 with Sigstore + and upload them to GitHub Release + if: startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes + needs: + - publish-to-pypi + runs-on: ubuntu-latest + + permissions: + contents: write # IMPORTANT: mandatory for making GitHub Releases + id-token: write # IMPORTANT: mandatory for sigstore + + steps: + - name: Download all the dists + uses: actions/download-artifact@v4 + with: + name: python-package-distributions + path: dist/ + - name: Sign the dists with Sigstore + uses: sigstore/gh-action-sigstore-python@v3.0.0 + with: + inputs: >- + ./dist/*.tar.gz + ./dist/*.whl + - name: Create GitHub Release + env: + GITHUB_TOKEN: ${{ github.token }} + run: >- + gh release create + "$GITHUB_REF_NAME" + --repo "$GITHUB_REPOSITORY" + --notes "" + - name: Upload artifact signatures to GitHub Release + env: + GITHUB_TOKEN: ${{ github.token }} + # Upload to GitHub Release using the `gh` CLI. + # `dist/` contains the built packages, and the + # sigstore-produced signatures and certificates. + run: >- + gh release upload + "$GITHUB_REF_NAME" dist/** + --repo "$GITHUB_REPOSITORY" From 9c90b155440f9567194c78a43a5491f54b1c4576 Mon Sep 17 00:00:00 2001 From: Michka Popoff Date: Fri, 14 Mar 2025 08:06:47 +0100 Subject: [PATCH 7/7] bump to version 3.0.1 --- CHANGELOG.md | 6 ++++++ pyproject.toml | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 38f0fe29..8859245d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,12 @@ Changes ======= +Version 3.0.1 +------------- + +1. Build and sign wheels using Github Actions CI, see https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ + This is a way better way to distribute our wheels as it prevents supply chain attacks. + Version 3.0.0 ------------- diff --git a/pyproject.toml b/pyproject.toml index cf3faace..de608dbd 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -19,7 +19,7 @@ keywords = [ "CastXML", "gccxml", ] -version = "3.0.0" +version = "3.0.1" classifiers = [ "Development Status :: 5 - Production/Stable",