github-workflows/.github/workflows/github-release.yaml at main · tox-dev/github-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
name: Publish GitHub Release
on:
  workflow_call:
    inputs:
      project:
        description: PyPI project name
        required: true
        type: string
      version:
        description: PyPI release version, without a package prefix from the tag
        required: true
        type: string
      tag:
        description: Release tag, such as 1.2.3 or pyproject-fmt/1.2.3
        required: true
        type: string
      artifact-pattern:
        description: Name pattern of the distribution artifacts the publisher uploaded
        required: true
        type: string
      notes-artifact-id:
        description: Artifact ID of the rendered GitHub Release notes
        required: true
        type: string
      title-prefix:
        description: Text before the tag in the GitHub Release title, such as v
        default: ""
        type: string
      assets-directory:
        description: Directory of extra GitHub Release assets; dist attaches the distributions
        default: ""
        type: string
      exclude-newer:
        description: Upload cutoff for the tools the shared Actions install from PyPI
        default: 7 days
        type: string
      exclude-newer-package:
        description: Newline-separated name=date cutoffs that override exclude-newer for single packages
        default: ""
        type: string
permissions: {}
jobs:
  github-release:
    name: 🚀 Publish GitHub Release
    runs-on: ubuntu-26.04
    environment: release
    permissions:
      contents: write
    steps:
      - name: 🚫 Refuse untrusted caller event
        env:
          EVENT_NAME: ${{ github.event_name }}
        run: |
          case "$EVENT_NAME" in
          pull_request | pull_request_target | workflow_run | issue_comment | merge_group)
            echo "::error::writer job refuses $EVENT_NAME callers; call it from push, schedule, workflow_dispatch or release"
            exit 1
            ;;
          esac
      - name: 📩 Download distributions
        id: distributions
        background: true
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: ${{ inputs.artifact-pattern }}
          path: dist
          merge-multiple: true
      - name: 📩 Download release notes
        id: notes
        background: true
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ inputs.notes-artifact-id }}
          path: ${{ runner.temp }}
      - name: 🐍 Install uv and Python
        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
        with:
          version: latest-known
          python-version: "3.15"
          enable-cache: false
          ignore-empty-workdir: true
      - name: ⏳ Wait for distributions
        wait: distributions
      - name: ⏳ Wait for release notes
        wait: notes
      - name: 🔍 Verify PyPI artifacts
        uses: $/reconcile-pypi-artifacts
        with:
          project: ${{ inputs.project }}
          version: ${{ inputs.version }}
          dist: dist
          exclude-newer: ${{ inputs.exclude-newer }}
          exclude-newer-package: ${{ inputs.exclude-newer-package }}
      - name: 🚀 Publish GitHub release
        uses: $/publish-github-release
        env:
          GH_TOKEN: ${{ github.token }}
        with:
          tag: ${{ inputs.tag }}
          commit: ${{ github.sha }}
          title: ${{ inputs.title-prefix }}${{ inputs.tag }}
          notes-file: ${{ runner.temp }}/release-notes.md
          assets-directory: ${{ inputs.assets-directory }}