From f30224a7d1e85491c29c6e4cbd3461be249a1174 Mon Sep 17 00:00:00 2001 From: Abdullah Alaqeel Date: Tue, 17 Oct 2023 12:23:22 +0300 Subject: [PATCH 1/7] ci: allow auto releasing to pypi --- .github/workflows/release.yaml | 35 ++++++++++++++++++++++++ .github/workflows/{main.yml => test.yml} | 5 ++-- 2 files changed, 37 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/release.yaml rename .github/workflows/{main.yml => test.yml} (97%) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml new file mode 100644 index 0000000..430983c --- /dev/null +++ b/.github/workflows/release.yaml @@ -0,0 +1,35 @@ +name: release +on: + push: + tags: + - '*' + +jobs: + release: + name: Upload release to PyPI + runs-on: ubuntu-latest + if: github.repository == 'pytest-dev/pytest-timeout' + + permissions: + id-token: write # IMPORTANT: this permission is mandatory for trusted publishing + + steps: + - uses: actions/checkout@v3 + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: 3.7 + + - name: Install dependencies + run: | + python -m pip install -U pip + python -m pip install -U build pytest>=5.0.0 + + - name: Build package + run: | + python -m build + python -m twine check dist/* + + - name: Publish package distributions to PyPI + if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') + uses: pypa/gh-action-pypi-publish@release/v1 diff --git a/.github/workflows/main.yml b/.github/workflows/test.yml similarity index 97% rename from .github/workflows/main.yml rename to .github/workflows/test.yml index 866622f..26006da 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/test.yml @@ -1,8 +1,7 @@ ---- -name: build +name: Test "on": [push, pull_request] jobs: - build: + test: runs-on: ${{ matrix.os }} strategy: fail-fast: false From 839d2a2132fdab133453b59a287be0faf951d438 Mon Sep 17 00:00:00 2001 From: Abdullah Alaqeel Date: Tue, 17 Oct 2023 21:33:41 +0300 Subject: [PATCH 2/7] Apply suggestions from code review Co-authored-by: Thomas Grainger --- .github/workflows/release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 430983c..8b44d11 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -18,12 +18,12 @@ jobs: - name: Set up Python uses: actions/setup-python@v4 with: - python-version: 3.7 + python-version: 3.12 - name: Install dependencies run: | python -m pip install -U pip - python -m pip install -U build pytest>=5.0.0 + python -m pip install -U build - name: Build package run: | From 381b533ccae3ce23e82f7b60e0ea347241f85ccf Mon Sep 17 00:00:00 2001 From: Abdullah Alaqeel Date: Thu, 19 Oct 2023 11:51:54 +0300 Subject: [PATCH 3/7] ci: change event to `release` --- .github/workflows/release.yaml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 8b44d11..57122c3 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -1,8 +1,7 @@ -name: release +name: Release on: - push: - tags: - - '*' + release: + types: [published] jobs: release: @@ -31,5 +30,4 @@ jobs: python -m twine check dist/* - name: Publish package distributions to PyPI - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') uses: pypa/gh-action-pypi-publish@release/v1 From 9c05b5c90637df430167a9a534d44352c47fca6a Mon Sep 17 00:00:00 2001 From: Floris Bruynooghe Date: Mon, 23 Oct 2023 20:13:31 +0200 Subject: [PATCH 4/7] Only check repo owner pytest-dev is not going to fork this and means it's more re-usable Co-authored-by: Hugo van Kemenade --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 57122c3..104a656 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -7,7 +7,7 @@ jobs: release: name: Upload release to PyPI runs-on: ubuntu-latest - if: github.repository == 'pytest-dev/pytest-timeout' + if: github.repository_owner == 'pytest-dev' permissions: id-token: write # IMPORTANT: this permission is mandatory for trusted publishing From 61bb7581f165f76eb20ce8cd1c48bf223cfd94dd Mon Sep 17 00:00:00 2001 From: Floris Bruynooghe Date: Mon, 23 Oct 2023 20:14:18 +0200 Subject: [PATCH 5/7] Use a generic stable python Otherwise we have to keep changing this. Co-authored-by: Hugo van Kemenade --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 104a656..da9c38a 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -17,7 +17,7 @@ jobs: - name: Set up Python uses: actions/setup-python@v4 with: - python-version: 3.12 + python-version: 3.x - name: Install dependencies run: | From 930376edfd0f1574cb681346657dbed84dd4c56b Mon Sep 17 00:00:00 2001 From: Abdullah Alaqeel Date: Mon, 17 Aug 2026 02:14:32 +0300 Subject: [PATCH 6/7] ci: harden release workflow and document release process - Split build and publish jobs: build with least privilege via build-and-inspect-python-package (includes twine check and GitHub build provenance attestation), publish with only id-token for PyPI Trusted Publishing - Publish via the release environment with PyPI attestations - Add RELEASING.rst documenting the release process --- .github/workflows/release.yaml | 42 ++++++++++++++++++++-------------- RELEASING.rst | 18 +++++++++++++++ 2 files changed, 43 insertions(+), 17 deletions(-) create mode 100644 RELEASING.rst diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index da9c38a..d563180 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -1,33 +1,41 @@ name: Release + on: release: types: [published] jobs: - release: - name: Upload release to PyPI + package: + name: Build and inspect package runs-on: ubuntu-latest if: github.repository_owner == 'pytest-dev' - permissions: - id-token: write # IMPORTANT: this permission is mandatory for trusted publishing + id-token: write # For build provenance attestation. + attestations: write steps: - - uses: actions/checkout@v3 - - name: Set up Python - uses: actions/setup-python@v4 + - uses: actions/checkout@v5 + - name: Build package and attest build provenance + uses: hynek/build-and-inspect-python-package@v3 with: - python-version: 3.x - - - name: Install dependencies - run: | - python -m pip install -U pip - python -m pip install -U build + attest-build-provenance-github: 'true' - - name: Build package - run: | - python -m build - python -m twine check dist/* + publish: + name: Upload release to PyPI + needs: package + runs-on: ubuntu-latest + if: github.repository_owner == 'pytest-dev' + environment: release + permissions: + id-token: write # For PyPI Trusted Publishing. + steps: + - name: Download package + uses: actions/download-artifact@v8 + with: + name: Packages + path: dist - name: Publish package distributions to PyPI uses: pypa/gh-action-pypi-publish@release/v1 + with: + attestations: true diff --git a/RELEASING.rst b/RELEASING.rst new file mode 100644 index 0000000..eb352ac --- /dev/null +++ b/RELEASING.rst @@ -0,0 +1,18 @@ +Releasing +========= + +1. Update the version in ``setup.cfg``. +2. Merge the PR to ``main``. +3. Create a `GitHub Release `_ + with tag ``X.Y.Z`` targeting ``main``. +4. The ``Release`` workflow builds the package, checks it, and publishes it + to PyPI. + +Notes for maintainers: + +- Publishing uses PyPI `Trusted Publishing + `_ via the ``release`` + environment: owner ``pytest-dev``, repo ``pytest-timeout``, workflow + ``release.yaml``, environment ``release``. +- The ``release`` GitHub environment can require maintainer approval + before the publish job runs. From fe7840a12f64b5903f86fcf9870154cdded8362c Mon Sep 17 00:00:00 2001 From: Abdullah Alaqeel Date: Mon, 17 Aug 2026 12:17:05 +0300 Subject: [PATCH 7/7] docs: fix CI badge after workflow rename --- README.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.rst b/README.rst index 02e5e8f..14c3286 100644 --- a/README.rst +++ b/README.rst @@ -10,7 +10,7 @@ pytest-timeout .. |anaconda| image:: https://img.shields.io/conda/vn/conda-forge/pytest-timeout.svg :target: https://anaconda.org/conda-forge/pytest-timeout -.. |ci| image:: https://github.com/pytest-dev/pytest-timeout/workflows/build/badge.svg +.. |ci| image:: https://github.com/pytest-dev/pytest-timeout/actions/workflows/test.yml/badge.svg :target: https://github.com/pytest-dev/pytest-timeout/actions .. |python| image:: https://img.shields.io/pypi/pyversions/pytest-timeout.svg