Skip to content

New: [AEA-5986] - Publish to PyPI #76

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
originalphil merged 10 commits into from
Mar 4, 2026
Merged

New: [AEA-5986] - Publish to PyPI #76

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
d1f3d22
AEA-5986 Add pypi plugin to semantic release.
originalphil Feb 27, 2026
fa5243b
AEA-5986 Add pypi plugin for semantic release.
originalphil Mar 2, 2026
a8fc173
AEA-5986 Install asdf dependencies when pypi_publish.
originalphil Mar 2, 2026
81fd8de
AEA-5986 Accept pypi token secrets.
originalphil Mar 3, 2026
6678e2d
AEA-5986 Handle bools as strings.
originalphil Mar 3, 2026
39c46df
AEA-5986 Rely on dry-run rather than publish to test index.
originalphil Mar 4, 2026
5d1c232
AEA-5986 Handle bool correctly in if condition.
originalphil Mar 4, 2026
f2bdb20
AEA-5986 Add PyPI values to env to create semantic release tag step.
originalphil Mar 4, 2026
fe9c4b7
AEA-5986 Add minimatch vulnerability to trivy ignore.
originalphil Mar 4, 2026
909fc18
AEA-5986 Remove branch-specific checkout.
originalphil Mar 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions .github/workflows/tag-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,11 @@ on:
description: "An repository for the extra artifact"
required: false
type: string
pypi_publish:
description: "Whether to publish to PyPI"
required: false
type: boolean
default: false
outputs:
version_tag:
value: ${{ jobs.tag_release.outputs.version_tag }}
Expand All @@ -59,6 +64,9 @@ on:
NPM_TOKEN:
required: false
description: "NPM token to publish packages"
PYPI_TOKEN:
required: false
description: "PyPI token to publish packages"
jobs:
install_semantic_release:
# Install asdf
Expand Down Expand Up @@ -231,7 +239,7 @@ jobs:
name: config_artifact

- name: Cache asdf
if: inputs.publish_packages != ''
if: ${{ inputs.publish_packages != '' || inputs.pypi_publish }}
uses: actions/cache@v5
with:
path: |
Expand All @@ -241,15 +249,15 @@ jobs:
${{ runner.os }}-asdf-

- name: Install asdf dependencies in .tool-versions
if: inputs.publish_packages != ''
if: ${{ inputs.publish_packages != '' || inputs.pypi_publish }}
uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47
with:
asdf_version: ${{ inputs.asdfVersion }}
env:
PYTHON_CONFIGURE_OPTS: --enable-shared

- name: Install Dependencies and Build Package
if: inputs.publish_packages != ''
if: ${{ inputs.publish_packages != '' || inputs.pypi_publish }}
run: |
make install
make build
Expand Down Expand Up @@ -320,6 +328,8 @@ jobs:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
MAIN_BRANCH: ${{ inputs.main_branch }}
EXTRA_ASSET: ${{ inputs.extra_artifact_name }}
PYPI_PUBLISH: ${{ inputs.pypi_publish }}
PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}

- name: Create semantic release tag
if: ${{ !inputs.dry_run }}
Expand All @@ -330,6 +340,8 @@ jobs:
TAG_FORMAT: ${{ inputs.tag_format }}
MAIN_BRANCH: ${{ inputs.main_branch }}
EXTRA_ASSET: ${{ inputs.extra_artifact_name }}
PYPI_PUBLISH: ${{ inputs.pypi_publish }}
PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
run: |
npx semantic-release --tag-format "${TAG_FORMAT}"

Expand Down
6 changes: 6 additions & 0 deletions .trivyignore.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,12 @@ vulnerabilities:
- id: CVE-2026-26996
statement: minimatch vulnerability accepted as risk
expired_at: 2026-06-01
- id: CVE-2026-27903
statement: minimatch vulnerability accepted as risk - dependency of npm (multiple)
expired_at: 2026-06-01
- id: CVE-2026-27904
statement: minimatch vulnerability accepted as risk - dependency of npm (multiple)
expired_at: 2026-06-01
- id: CVE-2026-26960
statement: tar vulnerability accepted as risk
expired_at: 2026-06-01
Loading