MAINT automate the pypi release process with CI and trusted publishing #548
Conversation
|
I will configure the trusted publisher on both pypi.org and testpypi.org. |
|
I did the required config. Let's merge to check if this works as expected on test.pypi.org. |
|
My "pending" trusted publisher config on testpypi.org does not seem to work as expected: https://github.com/cloudpipe/cloudpickle/actions/runs/12770251295/job/35594676819 I will try to create the cloudpickle project manually on test.pypi.org and reconfigure the trusted publisher on that project once it exists instead of using the pending config. |
|
I did that and configured the trusted publisher here: https://test.pypi.org/manage/project/cloudpickle/settings/publishing/ Let's try again by pushing an empty commit to |
|
I got another, but different error this time: https://github.com/cloudpipe/cloudpickle/actions/runs/12770664554/job/35596079248 |
|
Another fail with a similar error message: https://github.com/cloudpipe/cloudpickle/actions/runs/12770941887/job/35596981931 |
|
With verbose output we get: unfortunately, flit does not support git-based dev versioning: So either we switch to an alternative to flit that does, or we do not attempt to upload files with same names but different digests to testpypi. The |
I would like to ease the release process by automating it while improving security by leveraging the transparency (provenance tracking) and integrity checks (via signatures) of the trusted publishers' setup.
I am following the official guide here:
https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
The expected results of that workflow are:
masterto be able to test that the workflow works well;