From 747cea5cd3d3607769c569437d293da03d751ab1 Mon Sep 17 00:00:00 2001 From: Bruno Oliveira Date: Wed, 5 Aug 2026 19:54:45 -0300 Subject: [PATCH 01/10] Release 1.7.0 --- CHANGELOG.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 93586d9..9403f3f 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -1,5 +1,5 @@ -UNRELEASED -========== +v1.7.0 +====== * Drop support for EOL Python versions: 3.7, 3.8, 3.9. * Print proper child process exit status. From a97355109bf1d6e92db7945770738a8f0a55586a Mon Sep 17 00:00:00 2001 From: Bruno Oliveira Date: Wed, 5 Aug 2026 19:56:58 -0300 Subject: [PATCH 02/10] Improve RELEASING Clarify to push the branch to upstream and mention the expected tag format. --- RELEASING.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/RELEASING.rst b/RELEASING.rst index 1a9d8f2..ec884a8 100644 --- a/RELEASING.rst +++ b/RELEASING.rst @@ -1,7 +1,7 @@ Here are the steps on how to make a new release. -1. Create a ``release-VERSION`` branch from ``upstream/master``. +1. Create a ``release-`` branch from ``upstream/master``. 2. Update ``CHANGELOG.rst``. -3. Push a branch with the changes. -4. Once all builds pass, push a tag to ``upstream``. +3. Push a branch with the changes to ``upstream``. +4. Once all builds pass, push a tag to ``upstream`` in the format ``v``. 5. Merge the PR. From 3c0c2282982a4b406d147b1ea133bf85d121a4fe Mon Sep 17 00:00:00 2001 From: Bruno Oliveira Date: Wed, 5 Aug 2026 20:08:38 -0300 Subject: [PATCH 03/10] Modernize testing and deploy workflows * Build package once with `hynek/build-and-inspect-python-package` and test in multiple versions. * Use `hynek/build-and-inspect-python-package` during deploy. --- .github/workflows/deploy.yml | 28 +++++++++++++++++---- .github/workflows/test.yml | 47 ++++++++++++++++++++---------------- 2 files changed, 49 insertions(+), 26 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 475966f..936b9e9 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -7,21 +7,39 @@ on: jobs: - deploy: + package: runs-on: ubuntu-latest + # Required by attest-build-provenance-github. + permissions: + id-token: write + attestations: write + steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v7 + - name: Build and Check Package - uses: hynek/build-and-inspect-python-package@v1.5 + uses: hynek/build-and-inspect-python-package@v3.0.1 + with: + attest-build-provenance-github: 'true' + + deploy: + + needs: [package] + + runs-on: ubuntu-latest + + steps: - name: Download Package - uses: actions/download-artifact@v3 + uses: actions/download-artifact@v8 with: name: Packages path: dist + - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@v1.14.2 with: user: __token__ password: ${{ secrets.pypi_token }} + attestations: true diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3bc9f9b..276091c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -3,43 +3,48 @@ name: test on: [push, pull_request] jobs: + + package: + runs-on: ubuntu-latest + permissions: + id-token: write + attestations: write + steps: + - uses: actions/checkout@v7 + - name: Build and Check Package + uses: hynek/build-and-inspect-python-package@v3.0.1 + test: + needs: [package] + runs-on: ubuntu-latest strategy: fail-fast: false matrix: python: ["3.10", "3.11", "3.12", "3.13", "3.14"] - include: - - python: "3.10" - tox_env: "py310" - - python: "3.11" - tox_env: "py311" - - python: "3.12" - tox_env: "py312" - - python: "3.13" - tox_env: "py313" - - python: "3.14" - tox_env: "py314" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 + + - name: Download Package + uses: actions/download-artifact@v8 + with: + name: Packages + path: dist + - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: ${{ matrix.python }} + allow-prereleases: true + - name: Install tox run: | python -m pip install --upgrade pip pip install tox + - name: Test run: | - tox -e ${{ matrix.tox_env }} - - check-package: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Build and Check Package - uses: hynek/build-and-inspect-python-package@v2 + tox run -e py --installpkg `find dist/*.tar.gz` From f9f2dbd8ab9401b1caef9793a51769684f6f739c Mon Sep 17 00:00:00 2001 From: Bruno Oliveira Date: Wed, 5 Aug 2026 20:11:35 -0300 Subject: [PATCH 04/10] Bump changelog to v1.7.1 --- CHANGELOG.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 9403f3f..2aa8a5a 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -1,4 +1,4 @@ -v1.7.0 +v1.7.1 ====== * Drop support for EOL Python versions: 3.7, 3.8, 3.9. From 9153522844800a2716cc2a74ada9126f961a89ec Mon Sep 17 00:00:00 2001 From: Bruno Oliveira Date: Wed, 5 Aug 2026 20:15:05 -0300 Subject: [PATCH 05/10] Disable attestations Cannot use attestations together with a password; we might use attestations in a follow up. --- .github/workflows/deploy.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 936b9e9..a6539fa 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -11,18 +11,11 @@ jobs: runs-on: ubuntu-latest - # Required by attest-build-provenance-github. - permissions: - id-token: write - attestations: write - steps: - uses: actions/checkout@v7 - name: Build and Check Package uses: hynek/build-and-inspect-python-package@v3.0.1 - with: - attest-build-provenance-github: 'true' deploy: @@ -42,4 +35,3 @@ jobs: with: user: __token__ password: ${{ secrets.pypi_token }} - attestations: true From 9575abc5bd415927fe52ad1a54688275549ae072 Mon Sep 17 00:00:00 2001 From: Bruno Oliveira Date: Wed, 5 Aug 2026 20:15:18 -0300 Subject: [PATCH 06/10] Bump changelog to v1.7.2 --- CHANGELOG.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 2aa8a5a..d9aeb38 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -1,4 +1,4 @@ -v1.7.1 +v1.7.2 ====== * Drop support for EOL Python versions: 3.7, 3.8, 3.9. From e431cdf45b13ec03cc5de24524cca9370b52f687 Mon Sep 17 00:00:00 2001 From: Bruno Oliveira Date: Wed, 5 Aug 2026 20:23:40 -0300 Subject: [PATCH 07/10] Explicitly disable attestations in gh-action-pypi-publish (default is true) --- .github/workflows/deploy.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index a6539fa..5211974 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -35,3 +35,5 @@ jobs: with: user: __token__ password: ${{ secrets.pypi_token }} + # attestations requires trusted publishing, needs to be done in a follow up. + attestations: false From 76cee95f1049fd4b67974b657a30bf6e3cc3963a Mon Sep 17 00:00:00 2001 From: Bruno Oliveira Date: Wed, 5 Aug 2026 20:23:51 -0300 Subject: [PATCH 08/10] Bump changelog to v1.7.3 --- CHANGELOG.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.rst b/CHANGELOG.rst index d9aeb38..37e17c2 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -1,4 +1,4 @@ -v1.7.2 +v1.7.3 ====== * Drop support for EOL Python versions: 3.7, 3.8, 3.9. From f370dfd5bf37635b301b31690ff235e27016ba3a Mon Sep 17 00:00:00 2001 From: Bruno Oliveira Date: Wed, 5 Aug 2026 20:25:45 -0300 Subject: [PATCH 09/10] Use trusted publishing in deploy Seems like username and password are not supported anymore. --- .github/workflows/deploy.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 5211974..ff58583 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -11,11 +11,18 @@ jobs: runs-on: ubuntu-latest + # Required by attest-build-provenance-github. + permissions: + id-token: write + attestations: write + steps: - uses: actions/checkout@v7 - name: Build and Check Package uses: hynek/build-and-inspect-python-package@v3.0.1 + with: + attest-build-provenance-github: 'true' deploy: @@ -32,8 +39,3 @@ jobs: - name: Publish package to PyPI uses: pypa/gh-action-pypi-publish@v1.14.2 - with: - user: __token__ - password: ${{ secrets.pypi_token }} - # attestations requires trusted publishing, needs to be done in a follow up. - attestations: false From e12ab049b4a402360bf568c635378af974aebe0c Mon Sep 17 00:00:00 2001 From: Bruno Oliveira Date: Wed, 5 Aug 2026 20:26:45 -0300 Subject: [PATCH 10/10] Bump changelog to v1.7.4 --- CHANGELOG.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 37e17c2..5badf23 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -1,4 +1,4 @@ -v1.7.3 +v1.7.4 ====== * Drop support for EOL Python versions: 3.7, 3.8, 3.9.