publish_all.yml

# .github/workflows/publish_testpypi.yml
---
name: test-n-build
on:
  workflow_dispatch:
  push:
    tags:
      - v*
jobs:
  super-test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python_v: ["3.10", "3.12", "3.13", "3.14"]
    name: Build and Test
    runs-on: ${{ matrix.os }}
    env:
      UV_PYTHON: ${{ matrix.python_v }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
      - uses: astral-sh/setup-uv@v5
      - name: Install Dependencies
        if: ${{ matrix.os == 'ubuntu-latest' }}
        run: sudo apt-get update && sudo apt-get install xvfb
        timeout-minutes: 1
      # must actually checkout for version determination
      - run: git checkout ${{ github.ref_name }}
      - run: uv python install ${{ matrix.python_v }}
      # don't modify sync file! messes up version!
      - run: uv sync --all-extras --locked --no-sources
      - run: git status
      - run: git diff --quiet HEAD || { echo "Working tree dirty"; exit 1; }
      - run: uv build
      - name: Reinstall from wheel
        run: >
          uv pip install dist/changelogtxt_parser-$(uv
          run --no-sync --with setuptools-git-versioning
          setuptools-git-versioning)-py3-none-any.whl
      - run: uv run --no-sync python --version
      - name: Test
        if: ${{ ! runner.debug && matrix.os != 'ubuntu-latest' }}
        run: uv run pytest
        timeout-minutes: 8

  store-build:
    name: build release
    needs: super-test
    if: ${{ !cancelled() &&
      !failure() &&
      github.event_name == 'push' &&
      github.run_attempt == 1 }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v4
      - uses: actions/setup-python@v5
        with:
          python-version-file: "pyproject.toml"
      - run: git checkout ${{ github.ref_name }}
      - run: uv sync --frozen --all-extras
      - run: uv build
      - name: Store the distribution packages
        uses: actions/upload-artifact@v4
        with:
          name: python-package-distributions
          path: dist/

  github-release:
    name: >-
      Sign the Python 🐍 distribution 📦 with Sigstore
      and upload them to GitHub Release
    needs:
      - super-test
      - store-build
    if: ${{ !cancelled() &&
      !failure() &&
      github.event_name == 'push' &&
      github.run_attempt == 1 }}
    runs-on: ubuntu-latest

    permissions:
      contents: write # IMPORTANT: mandatory for making GitHub Releases
      id-token: write # IMPORTANT: mandatory for sigstore

    steps:
      - name: Download all the dists
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions
          path: dist/
      - name: Sign the dists with Sigstore
        uses: sigstore/gh-action-sigstore-python@v3.0.0
        with:
          inputs: >-
            ./dist/*.tar.gz
            ./dist/*.whl
      - name: Create GitHub Release
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: >-
          gh release create
          "$GITHUB_REF_NAME"
          --repo "$GITHUB_REPOSITORY"
          --notes ""
      - name: Upload artifact signatures to GitHub Release
        env:
          GITHUB_TOKEN: ${{ github.token }}
        # Upload to GitHub Release using the `gh` CLI.
        # `dist/` contains the built packages, and the
        # sigstore-produced signatures and certificates.
        run: >-
          gh release upload
          "$GITHUB_REF_NAME" dist/**
          --repo "$GITHUB_REPOSITORY"
  publish-to-pypi:
    name: >-
      Publish Python 🐍 distribution 📦 to PyPI
    needs:
      - super-test
      - store-build
      - github-release
    if: ${{ !cancelled() &&
      !failure() &&
      github.event_name == 'push' &&
      github.run_attempt == 1 }}
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/changelogtxt-parser
    # Signs this workflow so pypi trusts it
    permissions:
      id-token: write
    steps:
      - name: Download the dists
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions
          path: dist/
      - name: Push to PyPi
        uses: pypa/gh-action-pypi-publish@release/v1