Testing the git action for publishing to pypi

[Swetna]

Fixes #284

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.35%. Comparing base (3313161) to head (15bb6c5).
Report is 104 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2436      +/-   ##
==========================================
+ Coverage   71.50%   81.35%   +9.84%     
==========================================
  Files          54       49       -5     
  Lines        1783     1609     -174     
  Branches      221      208      -13     
==========================================
+ Hits         1275     1309      +34     
+ Misses        458      254     -204     
+ Partials       50       46       -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[anth-volk]

Please include a changelog entry and add Fixes #ISSUE_NUMBER to the PR description, as we describe in our README

[anth-volk]

Thanks for this. While this script looks sensible, I think it'd be better if we mimicked what we do in other repos, which involves just a set of tasks in push.yaml.

[anth-volk]

issue, blocking: We already have code that's a bit more lightweight to handle pushing to PyPI and that's baked into the push.yaml script; could you consult -us or -core on this?

[anth-volk]

Also, please write Fixes #ISSUE in the description

[anth-volk]

Thanks @Swetna. Added a couple concerns with this code.

[anth-volk]

issue, blocking: This will only run when we publish GitHub releases, which we do not

I'd recommend following the setup we use in -us, but with minor modifications where necessary. This is the relevant code:

  Publish:
    runs-on: ubuntu-latest
    if: |
      (github.repository == 'PolicyEngine/policyengine-us')
      && (github.event.head_commit.message == 'Update PolicyEngine US')
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.12
      - name: Publish a git tag
        run: ".github/publish-git-tag.sh || true"
      - name: Install package
        run: make install
      - name: Build package
        run: make
      - name: Publish a Python distribution to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ secrets.PYPI }}
          skip-existing: true

[anth-volk]

issue, blocking: Passage of this token is a security risk

We do use tokens like these elsewhere, so I understand why you did it this way. That said, passing a permissive token like this in a workflow has a ton of security concerns. Please follow this guide as far as you can, then let me know if/when you need me to get any information from PyPI.

[anth-volk]

Thanks @Swetna. I have a couple questions for resolution before we can approve and merge this.

[anth-volk]

nit, non-blocking: We don't typically have these blank lines between jobs

Please remove them

[anth-volk]

question, blocking?: Did you test this action at all locally?

[anth-volk]

question, blocking: Does this require configuration on our end within PyPI?

I believe it does, but haven't received any communication on it from your end.