Provide a full example of a GitHub Actions config, rather than small little pieces

[ctjlewis]

Removed.

[webknjaz]

Don't do that. Build in a separate job. Check out the URL on the repo front page and links in readme for good examples. There's a bigger PyPUG guide. Feel free to make a PR to make the link more visible. Otherwise, it's an action and putting huge workflow examples in the readme is a non starter. Different projects would have different workflows, anyway.

[webknjaz]

Enjoy a potential vulnerability with OIDC, then. Also, I'm talking about separate jobs, not actions or pipelines. Check the terminology you use. This repository is not meant to hold a copy of GitHub's docs anyway. Anyway, I'm not putting dangerous advice there either, it'd be irresponsible. If there's a reasonable improvement, though, I might consider it, as long as it's in the scope of this project.

[ctjlewis]

So, same action, different job for the build?

[webknjaz]

Same workflow, different job. Action is a reusable step within a job.

[ctjlewis]

There was actually a full workflow at the bottom of this page.

This is the best resource for this. Ideally this would be in the README under a <details> block or something.

Full workflow

```yaml name: Publish Python 🐍 distribution 📦 to PyPI and TestPyPI on: push jobs: build: name: Build distribution 📦 runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Set up Python uses: actions/setup-python@v4 with: python-version: "3.x" - name: Install pypa/build run: >- python3 -m pip install build --user - name: Build a binary wheel and a source tarball run: python3 -m build - name: Store the distribution packages uses: actions/upload-artifact@v3 with: name: python-package-distributions path: dist/ publish-to-pypi: name: >- Publish Python 🐍 distribution 📦 to PyPI if: startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes needs: - build runs-on: ubuntu-latest environment: name: pypi url: https://pypi.org/p/ # Replace with your PyPI project name permissions: id-token: write # IMPORTANT: mandatory for trusted publishing steps: - name: Download all the dists uses: actions/download-artifact@v3 with: name: python-package-distributions path: dist/ - name: Publish distribution 📦 to PyPI uses: pypa/gh-action-pypi-publish@release/v1 github-release: name: >- Sign the Python 🐍 distribution 📦 with Sigstore and upload them to GitHub Release needs: - publish-to-pypi runs-on: ubuntu-latest permissions: contents: write # IMPORTANT: mandatory for making GitHub Releases id-token: write # IMPORTANT: mandatory for sigstore steps: - name: Download all the dists uses: actions/download-artifact@v3 with: name: python-package-distributions path: dist/ - name: Sign the dists with Sigstore uses: sigstore/gh-action-sigstore-python@v1.2.3 with: inputs: >- ./dist/*.tar.gz ./dist/*.whl - name: Create GitHub Release env: GITHUB_TOKEN: ${{ github.token }} run: >- gh release create '${{ github.ref_name }}' --repo '${{ github.repository }}' --notes "" - name: Upload artifact signatures to GitHub Release env: GITHUB_TOKEN: ${{ github.token }} # Upload to GitHub Release using the `gh` CLI. # `dist/` contains the built packages, and the # sigstore-produced signatures and certificates. run: >- gh release upload '${{ github.ref_name }}' dist/** --repo '${{ github.repository }}' publish-to-testpypi: name: Publish Python 🐍 distribution 📦 to TestPyPI needs: - build runs-on: ubuntu-latest environment: name: testpypi url: https://test.pypi.org/p/ permissions: id-token: write # IMPORTANT: mandatory for trusted publishing steps: - name: Download all the dists uses: actions/download-artifact@v3 with: name: python-package-distributions path: dist/ - name: Publish distribution 📦 to TestPyPI uses: pypa/gh-action-pypi-publish@release/v1 with: repository-url: https://test.pypi.org/legacy/ ```