sqlmodel-encrypted-fields/.github/workflows/release.yml at main · script3r/sqlmodel-encrypted-fields · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
name: Release

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      tag:
        description: 'Existing version tag to publish (e.g. v0.2.0)'
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: release-${{ inputs.tag || github.ref_name }}
  cancel-in-progress: false

jobs:
  validate:
    uses: ./.github/workflows/tests.yml
    with:
      ref: ${{ format('refs/tags/{0}', inputs.tag || github.ref_name) }}

  build:
    needs: validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ format('refs/tags/{0}', inputs.tag || github.ref_name) }}
          persist-credentials: false
      - uses: actions/setup-python@v7
        with:
          python-version: '3.14'
      - name: Verify tag matches package metadata
        env:
          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
        run: |
          python - <<'PY'
          import os
          import tomllib
          from pathlib import Path
          version = tomllib.loads(Path('pyproject.toml').read_text())['project']['version']
          if os.environ['RELEASE_TAG'] != f'v{version}':
              raise SystemExit('Release tag must match pyproject.toml version')
          PY
      - run: python -m pip install build twine
      - run: python -m build
      - run: python -m twine check --strict dist/*
      - uses: actions/upload-artifact@v7
        with:
          name: distributions
          path: dist/*
          if-no-files-found: error

  publish-pypi:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/sqlmodel-encrypted-fields/
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: distributions
          path: dist
      - name: Publish with PyPI trusted publishing
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true

  publish-github:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ format('refs/tags/{0}', inputs.tag || github.ref_name) }}
          persist-credentials: false
      - uses: actions/download-artifact@v8
        with:
          name: distributions
          path: dist
      - name: Publish GitHub release and distributions
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
        run: |
          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release upload "$RELEASE_TAG" dist/* --clobber
          else
            gh release create "$RELEASE_TAG" dist/* --verify-tag --title "$RELEASE_TAG" --notes-file CHANGELOG.md
          fi

  verify-pypi:
    needs: publish-pypi
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ format('refs/tags/{0}', inputs.tag || github.ref_name) }}
          persist-credentials: false
      - uses: actions/setup-python@v7
        with:
          python-version: '3.14'
      - name: Install from PyPI and verify encryption
        env:
          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
        run: |
          version="${RELEASE_TAG#v}"
          python -m venv /tmp/pypi-test
          for attempt in 1 2 3 4 5; do
            /tmp/pypi-test/bin/python -m pip install --no-cache-dir "sqlmodel-encrypted-fields==$version" && break
            sleep 10
          done
          cd /tmp
          /tmp/pypi-test/bin/python "$GITHUB_WORKSPACE/scripts/smoke_test.py" "$version"