mirror of
https://github.com/Horizontal42/netsleuth.git
synced 2026-11-10 15:42:10 +03:00
46ced3da51
netsleuth confirmed free on PyPI (pypi.org/pypi/netsleuth/json -> 404). Publish still can't run until a PyPI Trusted Publisher is registered for this project and the pypi GitHub environment exists with a reviewer rule - both need account access this session doesn't have.
63 lines
2 KiB
YAML
63 lines
2 KiB
YAML
name: release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*.*.*"
|
|
|
|
jobs:
|
|
build-and-test:
|
|
runs-on: windows-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v3
|
|
|
|
- name: Sync base + optional extras
|
|
run: uv sync --extra tcptrace --extra ndt7
|
|
|
|
- name: Run test suite
|
|
run: uv run pytest -q
|
|
|
|
- name: Build wheel and sdist
|
|
run: uv build
|
|
|
|
- name: Verify extras install cleanly from the built wheel
|
|
shell: bash
|
|
run: |
|
|
python -m venv /tmp/wheel-check
|
|
/tmp/wheel-check/Scripts/pip install "$(ls dist/*.whl)[tcptrace,ndt7]"
|
|
/tmp/wheel-check/Scripts/netsleuth --help
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: dist
|
|
path: dist/
|
|
|
|
# Publishing is intentionally a separate, manually-approved job: a tag push
|
|
# builds and tests automatically, but a human still has to approve the
|
|
# `pypi` environment before this job runs and actually publishes.
|
|
#
|
|
# "netsleuth" confirmed free on PyPI 2026-08-09 (pypi.org/pypi/netsleuth/json
|
|
# -> 404). Before the first tag push actually publishes, still needed:
|
|
# 1. Register a PyPI Trusted Publisher for this not-yet-published project
|
|
# name at https://pypi.org/manage/account/publishing/ — no token needed,
|
|
# this workflow's OIDC identity gets authorized directly on pypi.org.
|
|
# Owner: Horizontal42, repo: netsleuth, workflow: release.yml,
|
|
# environment: pypi.
|
|
# 2. Create the `pypi` GitHub Environment (repo Settings → Environments)
|
|
# with a required-reviewer protection rule, so publishing needs a
|
|
# manual click even after the workflow triggers.
|
|
publish:
|
|
needs: build-and-test
|
|
runs-on: ubuntu-latest
|
|
environment: pypi
|
|
permissions:
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/download-artifact@v4
|
|
with:
|
|
name: dist
|
|
path: dist/
|
|
- uses: pypa/gh-action-pypi-publish@release/v1
|