Skip to content

Commit 84ac172

Browse files
aclark4lifeaclark4life
committed
WIP trusted publishing
1 parent 77b1a79 commit 84ac172

File tree

6 files changed

+347
-16
lines changed

6 files changed

+347
-16
lines changed

‎.github/dependabot.yml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
version: 2
2+
updates:
3+
# GitHub Actions
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
groups:
9+
actions:
10+
patterns:
11+
- "*"
12+
# Python
13+
- package-ecosystem: "pip"
14+
directory: "/"
15+
schedule:
16+
interval: "weekly"

‎.github/workflows/release-python.yml

+99
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: Python Wheels
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
tags:
7+
- "**"
8+
pull_request:
9+
workflow_dispatch:
10+
11+
concurrency:
12+
group: wheels-${{ github.ref }}
13+
cancel-in-progress: true
14+
15+
defaults:
16+
run:
17+
shell: bash -eux {0}
18+
19+
jobs:
20+
21+
build_dist:
22+
name: Build Distribution Files
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@v4
26+
with:
27+
fetch-depth: 0
28+
persist-credentials: false
29+
30+
- uses: actions/setup-python@v5
31+
with:
32+
# Build sdist on lowest supported Python
33+
python-version: '3.9'
34+
35+
- name: Install build
36+
run: |
37+
python -m pip install build
38+
39+
- name: build the dist files
40+
run: |
41+
python -m build .
42+
43+
- name: Upload the dist files
44+
uses: actions/upload-artifact@v4
45+
with:
46+
name: dist-${{ github.run_id }}
47+
path: ./dist/*.*
48+
49+
test_dist:
50+
needs: [build_dist]
51+
name: Test Distribution Files
52+
runs-on: ubuntu-latest
53+
steps:
54+
- uses: actions/checkout@v4
55+
with:
56+
fetch-depth: 0
57+
persist-credentials: false
58+
59+
- uses: actions/setup-python@v5
60+
with:
61+
# Build sdist on lowest supported Python
62+
python-version: '3.9'
63+
64+
- name: Download the dists
65+
uses: actions/download-artifact@v4
66+
with:
67+
name: dist-${{ github.run_id }}
68+
path: dist/
69+
70+
- name: Test the sdist
71+
run: |
72+
cd dist
73+
pip install *.tar.gz
74+
python -c "import flask_pymongo"
75+
pip uninstall -y flask_pymongo
76+
77+
- name: Test the wheel
78+
run: |
79+
cd dist
80+
pip install *.whl
81+
python -c "import flask_pymongo"
82+
pip uninstall -y flask_pymongo
83+
84+
publish:
85+
# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#publishing-the-distribution-to-pypi
86+
needs: [test_dist]
87+
if: startsWith(github.ref, 'refs/tags/')
88+
runs-on: ubuntu-latest
89+
environment: release
90+
permissions:
91+
id-token: write
92+
steps:
93+
- name: Download the dists
94+
uses: actions/download-artifact@v4
95+
with:
96+
name: dist-${{ github.run_id }}
97+
path: dist/
98+
- name: Publish distribution 📦 to PyPI
99+
uses: pypa/gh-action-pypi-publish@release/v1

‎.github/workflows/test-python.yml

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: Python Tests
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
8+
concurrency:
9+
group: tests-${{ github.ref }}
10+
cancel-in-progress: true
11+
12+
defaults:
13+
run:
14+
shell: bash -eux {0}
15+
16+
env:
17+
MIN_PYTHON: "3.9"
18+
MIN_MONGODB: "4.0"
19+
MAX_MONGODB: "8.0"
20+
21+
jobs:
22+
static:
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@v4
26+
with:
27+
persist-credentials: false
28+
fetch-depth: 0
29+
- name: Install uv
30+
uses: astral-sh/setup-uv@v5
31+
with:
32+
enable-cache: true
33+
python-version: ${{ matrix.python-version }}
34+
- uses: extractions/setup-just@v3
35+
- run: just install
36+
- run: just lint
37+
- run: just docs
38+
- run: just doctest
39+
build:
40+
runs-on: ${{ matrix.os }}
41+
strategy:
42+
matrix:
43+
os: ["ubuntu-latest", "macos-latest", "windows-latest"]
44+
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
45+
fail-fast: false
46+
name: CPython ${{ matrix.python-version }}-${{ matrix.os }}
47+
steps:
48+
- uses: actions/checkout@v4
49+
with:
50+
persist-credentials: false
51+
fetch-depth: 0
52+
- name: Install uv
53+
uses: astral-sh/setup-uv@v5
54+
with:
55+
enable-cache: true
56+
python-version: ${{ matrix.python-version }}
57+
- uses: extractions/setup-just@v3
58+
- name: Start MongoDB on Linux
59+
if: ${{ startsWith(runner.os, 'Linux') }}
60+
uses: supercharge/[email protected]
61+
with:
62+
mongodb-version: ${{ env.MAX_MONGODB }}
63+
mongodb-replica-set: test-rs
64+
- name: Start MongoDB on MacOS
65+
if: ${{ startsWith(runner.os, 'macOS') }}
66+
run: |
67+
brew tap mongodb/brew
68+
brew install mongodb/brew/mongodb-community@${MAX_MONGODB}
69+
brew services start mongodb-community@${MAX_MONGODB}
70+
- name: Start MongoDB on Windows
71+
if: ${{ startsWith(runner.os, 'Windows') }}
72+
shell: powershell
73+
run: |
74+
mkdir data
75+
mongod --remove
76+
mongod --install --dbpath=$(pwd)/data --logpath=$PWD/mongo.log
77+
net start MongoDB
78+
- run: just install
79+
- run: just test
80+
81+
build-min:
82+
runs-on: ubuntu-latest
83+
steps:
84+
- uses: actions/checkout@v4
85+
with:
86+
persist-credentials: false
87+
fetch-depth: 0
88+
- name: Install uv
89+
uses: astral-sh/setup-uv@v5
90+
with:
91+
enable-cache: true
92+
python-version: ${{ env.MIN_PYTHON }}
93+
- uses: extractions/setup-just@v3
94+
- name: Install uv
95+
uses: astral-sh/setup-uv@v5
96+
with:
97+
enable-cache: true
98+
python-version: ${{ env.MIN_PYTHON }}
99+
- uses: extractions/setup-just@v3
100+
- uses: supercharge/[email protected]
101+
with:
102+
mongodb-version: ${{ env.MIN_MONGODB }}
103+
mongodb-replica-set: test-rs
104+
- name: Run unit tests with minimum dependency versions
105+
run: |
106+
uv sync --python=${MIN_PYTHON} --resolution=lowest-direct
107+
just test

‎.github/workflows/zizmor.yml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: GitHub Actions Security Analysis with zizmor
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["**"]
8+
9+
jobs:
10+
zizmor:
11+
name: zizmor latest via Cargo
12+
runs-on: ubuntu-latest
13+
permissions:
14+
security-events: write
15+
steps:
16+
- name: Checkout repository
17+
uses: actions/checkout@v4
18+
with:
19+
persist-credentials: false
20+
- name: Setup Rust
21+
uses: actions-rust-lang/setup-rust-toolchain@v1
22+
- name: Get zizmor
23+
run: cargo install zizmor
24+
- name: Run zizmor
25+
run: zizmor --format sarif . > results.sarif
26+
env:
27+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28+
- name: Upload SARIF file
29+
uses: github/codeql-action/upload-sarif@v3
30+
with:
31+
sarif_file: results.sarif
32+
category: zizmor

‎.pre-commit-config.yaml

+66-15
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,67 @@
1-
# See https://pre-commit.com for more information
2-
# See https://pre-commit.com/hooks.html for more hooks
1+
32
repos:
4-
- repo: https://github.com/pre-commit/pre-commit-hooks
5-
rev: v3.2.0
6-
hooks:
7-
- id: trailing-whitespace
8-
- id: end-of-file-fixer
9-
- id: check-yaml
10-
- id: check-added-large-files
11-
- repo: https://github.com/astral-sh/ruff-pre-commit
12-
rev: v0.7.3
13-
hooks:
14-
- id: ruff
15-
args: [ --fix ]
16-
- id: ruff-format
3+
- repo: https://github.com/pre-commit/pre-commit-hooks
4+
rev: v5.0.0
5+
hooks:
6+
- id: check-added-large-files
7+
- id: check-case-conflict
8+
- id: check-toml
9+
- id: check-yaml
10+
- id: debug-statements
11+
- id: end-of-file-fixer
12+
- id: forbid-new-submodules
13+
- id: trailing-whitespace
14+
15+
# We use the Python version instead of the original version which seems to require Docker
16+
# https://github.com/koalaman/shellcheck-precommit
17+
- repo: https://github.com/shellcheck-py/shellcheck-py
18+
rev: v0.10.0.1
19+
hooks:
20+
- id: shellcheck
21+
name: shellcheck
22+
args: ["--severity=warning"]
23+
stages: [manual]
24+
25+
- repo: https://github.com/sirosen/check-jsonschema
26+
rev: 0.31.0
27+
hooks:
28+
- id: check-github-workflows
29+
args: ["--verbose"]
30+
31+
- repo: https://github.com/codespell-project/codespell
32+
rev: "v2.3.0"
33+
hooks:
34+
- id: codespell
35+
args: ["-L", "nd"]
36+
stages: [manual]
37+
38+
- repo: https://github.com/adamchainz/blacken-docs
39+
rev: "1.19.1"
40+
hooks:
41+
- id: blacken-docs
42+
additional_dependencies: [black==24.*]
43+
44+
- repo: https://github.com/pre-commit/pygrep-hooks
45+
rev: "v1.10.0"
46+
hooks:
47+
- id: rst-backticks
48+
- id: rst-directive-colons
49+
- id: rst-inline-touching-normal
50+
51+
- repo: https://github.com/hukkin/mdformat
52+
rev: 0.7.21
53+
hooks:
54+
- id: mdformat
55+
# Optionally add plugins
56+
additional_dependencies:
57+
- mdformat-gfm
58+
59+
- repo: https://github.com/astral-sh/ruff-pre-commit
60+
# Ruff version.
61+
rev: v0.9.1
62+
hooks:
63+
# Run the linter.
64+
- id: ruff
65+
args: [ --fix, --show-fixes ]
66+
# Run the formatter.
67+
- id: ruff-format

‎justfile

+27-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,28 @@
1+
docs_build := "docs/_build"
2+
sphinx_opts:= "-d " + docs_build + "/doctrees docs"
3+
4+
# Default target executed when no arguments are given.
5+
[private]
16
default:
2-
echo 'Hello, world!'
7+
@just --list
8+
9+
install:
10+
uv sync
11+
uv run pre-commit install
12+
13+
test *args:
14+
uv run pytest {{args}}
15+
16+
lint:
17+
uv run pre-commit run --hook-stage manual --all-files
18+
19+
docs:
20+
uv run sphinx-build -T -b html {{sphinx_opts}} {{docs_build}}
21+
22+
doctest:
23+
uv run python -m doctest -v examples/wiki/wiki.py
24+
uv run sphinx-build -E -b doctest {{sphinx_opts}} {{docs_build}}/doctest
25+
uv run sphinx-build -b linkcheck {{sphinx_opts}} {{docs_build}}/linkcheck
26+
27+
typing:
28+
uv run mypy --install-types --non-interactive .

0 commit comments

Comments
 (0)