RestrictedPython/.github/workflows/tests.yml at master · zopefoundation/RestrictedPython · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
# Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
# https://github.com/zopefoundation/meta/tree/master/src/zope/meta/pure-python
name: tests

on:
  push:
  pull_request:
  schedule:
    - cron: '0 12 * * 0'  # run once a week on Sunday
  # Allow to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  build:
    permissions:
      contents: read
      pull-requests: write
    strategy:
      # We want to see all failures:
      fail-fast: false
      matrix:
        os:
        - ["ubuntu", "ubuntu-latest"]
        - ["windows", "windows-latest"]
        config:
        # [Python version, tox env]
        - ["3.11", "release-check"]
        - ["3.10", "py310"]
        - ["3.11", "py311"]
        - ["3.12", "py312"]
        - ["3.13", "py313"]
        - ["3.14", "py314"]
        - ["3.15", "py315"]
        - ["3.11", "docs"]
        - ["3.11", "coverage"]
        - ["3.11", "py311-datetime"]
        exclude:
          - { os: ["windows", "windows-latest"], config: ["3.11", "release-check"] }
          - { os: ["windows", "windows-latest"], config: ["3.11", "docs"] }
          - { os: ["windows", "windows-latest"], config: ["3.11", "coverage"] }

    runs-on: ${{ matrix.os[1] }}
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    name: ${{ matrix.os[0] }}-${{ matrix.config[1] }}
    steps:
    - uses: actions/checkout@v7
      with:
        persist-credentials: false
    - name: Install uv + caching
      # astral/setup-uv@10.0.1
      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
      with:
        enable-cache: true
        cache-dependency-glob: |
          setup.*
          tox.ini
        python-version: ${{ matrix.config[0] }}
        github-token: ${{ secrets.GITHUB_TOKEN }}
    - name: Test
      # The `coverage` environment combines the data written by the test
      # environments, so it has to run them: each job gets its own machine
      # and there would be nothing to combine otherwise.
      run: |
        uvx --with tox-uv tox ${{ matrix.config[1] == 'coverage' && '--skip-env "(docs|lint|release-check)"' || format('-e {0}', matrix.config[1]) }}
    - name: Coverage
      if: matrix.config[1] == 'coverage'
      run: |
        uvx coveralls --service=github
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Build package artifacts
      if: >
        matrix.os[0] == 'ubuntu'
        && matrix.config[1] == 'py314'
      run: |
        rm -f dist/*
        pip install -U packaging "setuptools >= 78.1.1,< 82" wheel twine
        python setup.py sdist
        python setup.py bdist_wheel

    - name: Upload package wheel
      if: >
        matrix.os[0] == 'ubuntu'
        && matrix.config[1] == 'py314'
      uses: actions/upload-artifact@v7
      with:
        name: RestrictedPython.whl
        path: dist/*whl

    - name: Upload package source distribution
      if: >
        matrix.os[0] == 'ubuntu'
        && matrix.config[1] == 'py314'
      uses: actions/upload-artifact@v7
      with:
        name: RestrictedPython.tar.gz
        path: dist/*gz

  publish:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    # Only publish on tag pushes
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
    # Wait for build jobs to complete
    needs: [build]
    environment:
      name: pypi
      url: https://pypi.org/p/RestrictedPython
    permissions:
      contents: read
      id-token: write  # Mandatory for trusted publishing

    steps:
      - name: Download package artifacts
        uses: actions/download-artifact@v8
        with:
          path: dist/
          pattern: '*'
          merge-multiple: true

      - name: Display structure of downloaded files
        run: |
          ls -lR dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
        with:
          skip-existing: true
          packages-dir: dist/
          verbose: true