Use new create package action with attestation (forked repo action)

beeware · May 27, 2024 · c94afec · c94afec
1 parent e870a75
commit c94afec
Show file tree

Hide file tree

Showing 4 changed files with 70 additions and 46 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -5,16 +5,25 @@ on:
     branches:
       - main
   workflow_call:
+    inputs:
+      attest-package:
+        description: "Create GitHub provenance attestation for the package."
+        default: "false"
+        type: string
     outputs:
       artifact-name:
         description: "Name of the uploaded artifact; use for artifact retrieval."
         value: ${{ jobs.package.outputs.artifact-name }}
 
 # Cancel active CI runs for a PR before starting another run
 concurrency:
-  group: ${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash
+
 env:
   FORCE_COLOR: "1"
 
@@ -32,14 +41,19 @@ jobs:
       runner-os: macos-latest
 
   package:
-    name: Python Package
-    uses: beeware/.github/.github/workflows/python-package-create.yml@main
+    name: Package Toga-Chart
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+#    uses: beeware/.github/.github/workflows/python-package-create.yml@main
+    uses: rmartin16/.github-beeware/.github/workflows/python-package-create.yml@hynek-build
     with:
-      runner-os: macos-latest
+      attest: ${{ inputs.attest-package }}
 
   unit-tests:
     name: Python compatibility test
-    needs: [pre-commit, towncrier, package]
+    needs: [ pre-commit, towncrier, package ]
     runs-on: macos-latest
     strategy:
       fail-fast: false
@@ -57,6 +71,12 @@ jobs:
       with:
         fetch-depth: 0
 
+    - name: Checkout beeware/.github
+      uses: actions/checkout@v4.1.6
+      with:
+        repository: beeware/.github
+        path: .github-beeware
+
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v5.1.0
       with:
@@ -68,12 +88,13 @@ jobs:
         name: ${{ needs.package.outputs.artifact-name }}
         path: dist
 
-    - name: Install dev dependencies
+    - name: Install Tox
+      working-directory: ./.github-beeware/scripts
       run: |
-        # We don't actually want to install toga_chart;
-        # we just want the dev extras so we have a known version of tox.
-        python -m pip install $(ls dist/toga_chart-*.whl)[dev]
+        python -m pip install --upgrade pip
+        python -m pip install --upgrade setuptools build wheel
+        # Utility script installs tox as defined in pyproject.toml
+        python -m install_requirement tox --extra dev --project-root ${{ github.workspace }}
 
     - name: Test
-      run: |
-        tox -e py --installpkg dist/toga_chart-*.whl
+      run: tox -e py --installpkg dist/toga_chart-*.whl
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -7,7 +7,10 @@ on:
 
 jobs:
   ci:
+    name: CI
     uses: ./.github/workflows/ci.yml
+    with:
+      attest-package: "true"
 
   docs:
     name: Verify Docs Build
@@ -26,7 +29,7 @@ jobs:
       # This permission is required for trusted publishing.
       id-token: write
     steps:
-      - name: Set build variables
+      - name: Set Build Variables
         run: |
           echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_ENV
 
@@ -35,13 +38,13 @@ jobs:
         with:
           python-version: "3.x"
 
-      - name: Get packages
+      - name: Get Package
         uses: actions/download-artifact@v4.1.7
         with:
           name: ${{ needs.ci.outputs.artifact-name }}
           path: dist
 
-      - name: Install packages
+      - name: Install Package
         run: pip install dist/*.whl
 
       - name: Check version number

diff --git a/changes/131.misc.rst b/changes/131.misc.rst
@@ -0,0 +1 @@
+``hynek/build-and-inspect-python-package`` is now used to create the Python package.
diff --git a/tox.ini b/tox.ini
@@ -19,56 +19,55 @@ skip_missing_interpreters = true
 extras =
     dev
 commands =
-    pytest -vv
+    python -m pytest {posargs:-vv --color yes}
 
-[testenv:towncrier-check]
-deps =
-    {[testenv:towncrier]deps}
-commands =
-    python -m towncrier.check --compare-with=origin/main
-
-[testenv:towncrier]
+[testenv:towncrier{,-check}]
+skip_install = True
 deps =
-    towncrier ~= 22.8
+    towncrier==23.11.0
 commands =
-    towncrier {posargs}
+    check  : python -m towncrier.check --compare-with origin/main
+    !check : python -m towncrier {posargs}
 
 [docs]
-build_dir = _build
-# -W: make warnings into errors
-# --keep-going: continue on errors
-# -j: run with multiple processes
-# -n: nitpick mode
-sphinx_args = -W --keep-going -j auto -n
-# -v: verbose logging
-# -E: force rebuild of environment
-# -T: print traceback on error
-# -a: read/parse all files
-# -d: use tox's temp dir for caching
-sphinx_args_extra = {[docs]sphinx_args} -v -E -T -a -d {envtmpdir}/doctrees
+docs_dir = {tox_root}{/}docs
+build_dir = {[docs]docs_dir}{/}_build
+# replace when Sphinx>=7.3 and Python 3.8 is dropped:
+#  -T => --show-traceback
+#  -W => --fail-on-warning
+#  -b => --builder
+#  -v => --verbose
+#  -a => --write-all
+#  -E => --fresh-env
+sphinx_args = -T -W --keep-going --jobs auto
 
-[testenv:docs{,-lint,-all}]
-change_dir = docs
+[testenv:docs{,-lint,-all,-live}]
+package = wheel
+wheel_build_env = .pkg
+extras = docs
 passenv =
     # On macOS M1, you need to manually set the location of the PyEnchant
     # library:
     #     export PYENCHANT_LIBRARY_PATH=/opt/homebrew/lib/libenchant-2.2.dylib
     PYENCHANT_LIBRARY_PATH
-extras =
-    docs
 commands =
-    !lint-!all : python -m sphinx {[docs]sphinx_args} -b html . {[docs]build_dir}/html
-    lint : python -m sphinx {[docs]sphinx_args_extra} -b linkcheck . {[docs]build_dir}/links
-    lint : python -m sphinx {[docs]sphinx_args_extra} -b spelling . {[docs]build_dir}/spell
-    all  : python -m sphinx {[docs]sphinx_args_extra} -b html . {[docs]build_dir}/html
+    !lint-!all-!live : python -m sphinx {[docs]sphinx_args} {posargs} -b html {[docs]docs_dir} {[docs]build_dir}{/}html
+    lint : python -m sphinx {[docs]sphinx_args} {posargs} -b spelling {[docs]docs_dir} {[docs]build_dir}{/}spell
+    lint : python -m sphinx {[docs]sphinx_args} {posargs} -b linkcheck {[docs]docs_dir} {[docs]build_dir}{/}links
+    all  : python -m sphinx {[docs]sphinx_args} {posargs} -v -a -E -b html {[docs]docs_dir} {[docs]build_dir}{/}html
+    live : sphinx-autobuild {[docs]sphinx_args} {posargs} -b html {[docs]docs_dir} {[docs]build_dir}{/}live
 
 [testenv:package]
+skip_install = True
+passenv = FORCE_COLOR
 deps =
     build==1.2.1
+    check-wheel-contents==0.6.0
     twine==5.1.0
 commands =
-    python -m build --outdir dist/
-    python -m twine check dist/*
+    python -m build . --outdir dist{/}
+    python -m twine check dist{/}*
+    check-wheel-contents dist{/}
 
 [testenv:publish]
 skip_install = True