Publish blurb to PyPI using Trusted Publishers

[hugovk]

The short story

It would be nice to automate releases.

Long version

Similar to cherry_picker (https://github.com/python/cherry-picker/pull/94), let's set up automated deploys to PyPI.

We'll need to pick a tag name format, so far we only have cherry-picker-vX.Y.Z in this repo: https://github.com/python/core-workflow/tags. Shall we use blurb-vX.Y.Z here?

TODO

• [x] Move blurb to own repo https://github.com/python/core-workflow/issues/329
• [x] Decide on tag name
• [x] Reserve blurb on https://test.pypi.org/project/blurb/
• [ ] Add other people to https://test.pypi.org/project/blurb/ to improve bus factor - who else shall I add there?
• [x] Create release workflow: python/blurb#14
• [x] Set up Trusted Publisher on https://test.pypi.org/project/blurb/
• [ ] Set up Trusted Publisher on https://pypi.org/project/blurb/

Thanks for blurb!

[ezio-melotti]

I would add "move blurb to its own repo" at the top of the checklist, otherwise sounds good to me.

[hugovk]

Added!

Once in its own repo, we don't need to worry about tag collisions and can use a more standard X.Y.Z or vX.Y.Z.

[hugovk]

blurb is now in its own repo 🚀

Once in its own repo, we don't need to worry about tag collisions and can use a more standard X.Y.Z or vX.Y.Z.

No strong preference from me, some prefer vX.Y.Z because it allows matching with a v* wildcard. We also X.Y.Z for branches and vX.Y.Z for tags in https://github.com/python/cpython, so "copy CPython" is good enough for me: let's use vX.Y.Z.

---

I've set up the Trusted Publisher for TestPyPI at https://test.pypi.org/manage/project/blurb/settings/publishing/

Here's a PR to add the release workflow: python/blurb#14. We can merge this before setting it up on production PyPI, it'll verify the TestPyPI setup.

Then we need to set up production PyPI before doing a proper release.

[webknjaz]

@hugovk I suggest using a GitHub Environment called testpypi for the TestPyPI uploads and pypi for the regular PyPI. This is what I use in the guides and IRL.

[hugovk]

I merged https://github.com/python/blurb/pull/14 and it successfully deployed in https://github.com/python/blurb/actions/runs/8661563398/job/23751747417 to https://test.pypi.org/project/blurb/0.1.dev64/ ✅

[hugovk]

[ ] Add other people to test.pypi.org/project/blurb to improve bus factor - who else shall I add there?

@ambv Can I add you? Do you have a Test PyPI account?

---

[ ] Set up Trusted Publisher on pypi.org/project/blurb

I see Brett and Larry listed at https://pypi.org/project/blurb/

@brettcannon or @larryhastings:

Please could you either set up Trusted Publishers for blurb here using the same settings as https://github.com/python/blurb/issues/4#issuecomment-2025547910

OR add @ambv and I'll ask him to do it?

Thanks!

[ambv]

I'm happy to help! I'm ambvtest on test.pypi.org.

[hugovk]

Thanks, invited!

[ambv]

Accepted!

[webknjaz]

Please could you either set up Trusted Publishers for blurb here using the same settings as #4 (comment)

Correction: the settings should be almost the same. The Environment name field must be pypi per https://github.com/python/blurb/commit/4bcc5b17a5ccb77296389e59371047671c43a126. In case of a mismatch, PyPI will reject uploads.