-
Notifications
You must be signed in to change notification settings - Fork 108
Migrate project management to uv #668
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: develop
Are you sure you want to change the base?
Changes from all commits
8d2064d
d51fe59
603cfe1
75e7b15
a9c59d8
2aa5657
29d5586
4e49afa
1ef6cd5
1cfb0d3
1d96b01
f1967fb
5e3487d
be5d10a
036b69a
a0abbc6
c725ff6
771bfb5
a02343f
9280e49
b3c64bf
c1acf09
651d6ba
30c5623
0fa744c
3d06f97
caa42da
2782785
bbda1dd
674a4a0
52f73a7
72bb9f6
9d26386
b92c762
f37202a
a6f6127
da8d1a8
2b9a1ca
70cdefa
2b6e228
de49fd5
64a3407
5a628b4
2fd2467
bb9b7f2
a00dbfe
c3c98cc
e702609
c2cf579
3b3d686
dbc2d0c
a793e38
dae11aa
ae6b587
38e3620
a4afb68
e10261d
b6e36c3
724a60e
1e984b8
b651292
60d9fc2
ba975f4
aa536f9
79ffa49
c2f8e43
fffb354
76ed558
cb734ee
97b6a3f
2547715
18ed1df
592192b
622c83d
04efdfe
72ed470
fb09fd1
ab37a78
f83a3d6
f0c678c
3e72b6a
6cb313d
82fd669
0ec24a9
d9e0407
590f742
99dcdee
b305f1d
ec098e6
cded68c
83da275
e75877d
8381363
4b8de70
e4a56d8
956e62d
1415279
d0112f7
004248e
2821ac7
6b93356
d4dd508
acdb6e6
f5ad1de
54e26fe
3746d30
ff75cf8
6e67420
f393f6e
9c9417c
afd68f4
a3c7b39
96ad228
d95f42a
80974e4
dd17940
7c25a90
b9e447d
23a37eb
48e0550
7e03aee
3e15a7a
d521a5c
1c22cdb
d553d40
6bef0a9
fb93001
6eacefe
252a04e
29a36c9
d09fb57
7c46aa3
abb64fe
d02cf27
46977c2
21b297e
909275f
d213622
08b02fd
a90e109
2460b0f
55ce123
d7f974b
691b3e4
bbac354
1114942
2eb564b
bd4c092
33a96ac
efddd61
8225bcd
1055b4f
cc5d36a
c6c74f5
d6ecd7a
4b48583
1d90952
c1d90aa
4abcb67
a407462
8e905b8
b300703
4f3d6fd
3e035f9
e026759
f7e1c88
e694b6b
d133211
f2afb29
a0525bd
0ff5e9f
41ed323
02afa18
8e1a443
e63610d
79b1cae
3d91682
0d7bf79
8f9c010
ce54a67
54b7275
161ea42
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
This file was deleted.
|
Collaborator
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. workflow to publish release -- maybe more motivation here to build some smoke tests |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| name: "Publish" | ||
|
|
||
| on: | ||
| push: | ||
| tags: | ||
| # Publish on any tag starting with a `v`, e.g., v0.1.0 | ||
| - v* | ||
|
|
||
| jobs: | ||
| run: | ||
| runs-on: ubuntu-latest | ||
| environment: | ||
| name: pypi | ||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v5 | ||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@v7 | ||
| - name: Install Python | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Why is a python installation step necessary? If using the |
||
| run: uv python install 3.13 | ||
| - name: Build | ||
| run: uv build | ||
| # TODO: add some smoke tests here | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. If you do decide to add smoke tests, I think as a matter of security, you should separate the build+test and publish steps into separate stages. e.g. here https://github.com/usethis-python/usethis-python/blob/main/.github/workflows/release.yml The risk is that a compromised test dependency injects a payload into the testing runtime which pre-emptively publishes a malicious package to PyPI, since it's scoped under the You can read more about this from the Astral team here https://docs.pyx.dev/publishing#trusted-publishing
In general (in a follow up PR) it might be good to consider using zizmor to shore up the GitHub Actions config a bit, from a security perspective |
||
| # - name: Smoke test (wheel) | ||
| # run: uv run --isolated --no-project --with dist/*.whl tests/smoke_test.py | ||
| # - name: Smoke test (source distribution) | ||
| # run: uv run --isolated --no-project --with dist/*.tar.gz tests/smoke_test.py | ||
| - name: Publish | ||
| run: uv publish | ||
| # The part below with testpypi only | ||
| # TODO: remove the next two lines for production usage | ||
| env: | ||
|
Collaborator
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. currently just pointing to test.pypi |
||
| UV_PUBLISH_URL: https://test.pypi.org/legacy/ | ||
|
Collaborator
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. can be refined after merge |
|
Collaborator
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. options now in pyproject.toml |
This file was deleted.
Uh oh!
There was an error while loading. Please reload this page.