python-sshnpd-build-publish.yml

name: Build and publish sshnpd PyPI package

on:
  workflow_dispatch:
  push:
    tags:
      - 'p*.*.*'
    branches:
      - trunk
    paths:
      - 'packages/python/sshnpd/**'

permissions:  # added using https://github.com/step-security/secure-repo
  contents: read

jobs:
  build:
    name: Build package
    runs-on: ubuntu-latest
    steps:
    - name: Checkout this repo
      uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5

    - name: Set up Python
      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
          python-version: '3.11'

    - name: Install Poetry
      uses: abatilo/actions-poetry@7b6d33e44b4f08d7021a1dee3c044e9c253d6439 # v3.0.0
      with:
        poetry-version: '1.8.3'

    # The dark mode and light mode Atsign logos in the GitHub README don't
    # show properly on PyPI so we have a copy of the README.md in
    # README.PyPI.md with just the light mode logo.
    # This step checks that we don't have drift between the docs.
    - name: Check that READMEs are in sync
      working-directory: packages/python/sshnpd
      run: |
        diff <(tail -n +2 README.md) <(tail -n +2 README.PyPI.md)

    - name: Build using Poetry
      working-directory: packages/python/sshnpd
      run: |
        poetry build
        cp -r dist/ $GITHUB_WORKSPACE

    - name: Store the distribution packages
      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
      with:
        name: sshnpd-python-package
        path: dist/

  publish-to-testpypi:
    name: Publish package to TestPyPI
    needs:
    - build
    runs-on: ubuntu-latest

    environment:
      name: testpypi
      url: https://test.pypi.org/p/sshnpd

    permissions:
      id-token: write  # IMPORTANT: mandatory for trusted publishing

    steps:
    - name: Download all the dists
      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
      with:
        name: sshnpd-python-package
        path: dist/
    - name: Publish distribution to TestPyPI
      uses: pypa/gh-action-pypi-publish@81e9d935c883d0b210363ab89cf05f3894778450 # v1.8.14
      with:
        skip-existing: true
        repository-url: https://test.pypi.org/legacy/

  publish-to-pypi:
    name: Publish package to PyPI
    if: startsWith(github.ref, 'refs/tags/p')  # only publish to PyPI on tag pushes
    needs:
    - build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/sshnpd
    permissions:
      id-token: write  # IMPORTANT: mandatory for trusted publishing

    steps:
    - name: Download all the dists
      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
      with:
        name: sshnpd-python-package
        path: dist/
    - name: Publish distribution to PyPI
      uses: pypa/gh-action-pypi-publish@81e9d935c883d0b210363ab89cf05f3894778450 # v1.8.14

  github-release:
    name: >-
      Sign the Python distribution with Sigstore
      and upload them to GitHub Release
    needs:
    - publish-to-pypi
    runs-on: ubuntu-latest

    permissions:
      contents: write  # IMPORTANT: mandatory for making GitHub Releases
      id-token: write  # IMPORTANT: mandatory for sigstore

    steps:
    - name: Download all the dists
      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
      with:
        name: sshnpd-python-package
        path: dist/
    - name: Sign the dists with Sigstore
      uses: sigstore/gh-action-sigstore-python@61f6a500bbfdd9a2a339cf033e5421951fbc1cd2 # v2.1.1
      with:
        inputs: >-
          ./dist/*.tar.gz
          ./dist/*.whl
    - name: Upload artifact signatures to GitHub Release
      env:
        GITHUB_TOKEN: ${{ github.token }}
      # Upload to GitHub Release using the `gh` CLI.
      # `dist/` contains the built packages, and the
      # sigstore-produced signatures and certificates.
      run: >-
        gh release upload
        '${{ github.ref_name }}' dist/**
        --repo '${{ github.repository }}'