Repository navigation
fix: keep the session cookies when a refresh fails transiently (#37) #25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Releases with release-please (configured in release-please-config.json). | |
| # | |
| # On every push to main, release-please opens or updates a release PR with the | |
| # next version (pyproject.toml) and changelog, from the Conventional Commits since | |
| # the last release. Merging it tags vX.Y.Z and creates the GitHub release; the | |
| # publish job then checks, builds and uploads the package to PyPI. | |
| # | |
| # Publishing uses PyPI trusted publishing (OIDC): no PyPI token is stored in this | |
| # repository. The project's trusted publisher on PyPI names this repository, this | |
| # workflow file and the pypi environment. | |
| # | |
| # A release whose publish failed can be published again by hand: run this | |
| # workflow with the release's tag. It publishes that tag and nothing else. | |
| # | |
| # Release PRs are opened with the default GITHUB_TOKEN, so CI waits for approval | |
| # on them. They change only the version and the changelog, and the publish job | |
| # runs the full checks before it uploads. | |
| name: release | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: An existing release tag to publish (vX.Y.Z) | |
| required: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| release-please: | |
| name: Release PR | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| if: github.repository_owner == 'fells-code' && github.event_name == 'push' | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| outputs: | |
| release_created: ${{ steps.release.outputs.release_created }} | |
| tag_name: ${{ steps.release.outputs.tag_name }} | |
| steps: | |
| - uses: googleapis/release-please-action@v5 | |
| id: release | |
| with: | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| publish: | |
| name: Publish to PyPI | |
| needs: release-please | |
| if: >- | |
| !cancelled() && github.repository_owner == 'fells-code' && | |
| (needs.release-please.outputs.release_created == 'true' || github.event_name == 'workflow_dispatch') | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| environment: | |
| name: pypi | |
| url: https://pypi.org/project/seamless-auth/ | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ inputs.tag || needs.release-please.outputs.tag_name }} | |
| persist-credentials: false | |
| - name: The tag is a release of this version | |
| env: | |
| TAG: ${{ inputs.tag || needs.release-please.outputs.tag_name }} | |
| run: | | |
| echo "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$' || { echo "not a release tag: $TAG"; exit 1; } | |
| git rev-parse -q --verify "refs/tags/$TAG" > /dev/null || { echo "no such tag: $TAG"; exit 1; } | |
| version=$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2) | |
| [ "v$version" = "$TAG" ] || { echo "pyproject.toml says $version, tag is $TAG"; exit 1; } | |
| - uses: astral-sh/setup-uv@v10.2.0 | |
| with: | |
| python-version: '3.13' | |
| - name: Checks | |
| # Frozen: the locked dependencies exactly, without checking the project's | |
| # own version in the lockfile, which a tag cut before release-please bumped | |
| # uv.lock (v0.1.0) still has as the previous one. CI holds main to --locked. | |
| run: | | |
| uv sync --frozen | |
| uv run ruff check . | |
| uv run mypy | |
| uv run pytest | |
| - run: uv build | |
| - uses: pypa/gh-action-pypi-publish@v1.14.2 |