release: 0.5.0 — the validation line (all ledgers empty), PRIVATE fol… #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Publishes to PyPI when a version tag is pushed, and NOT otherwise. | |
| # | |
| # No credentials live here. The publish job uses PyPI Trusted Publishing | |
| # (OIDC), so there is no API token in a secret to leak or rotate -- which is | |
| # why the old publish job was deleted from this repo in the first place. See | |
| # the note at the top of tests.yml. | |
| # | |
| # The guards in `scripts/check_release.py` run BEFORE the upload, and each one | |
| # exists because the failure it catches actually shipped: | |
| # * licensed Hero Games content in the artifact | |
| # * a dependency floor lower than the version the code needs | |
| # * the module's __version__ disagreeing with its own metadata | |
| # * a tag that does not match the built version | |
| # On 2026-08-25 the first release in two days tripped three of the four, all | |
| # found by hand. This is that check, automated. | |
| on: | |
| push: | |
| tags: ["v*"] | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install the package and its test deps | |
| run: pip install -e .[dev] | |
| - name: Run the test suite | |
| # Real-character tests skip here by design: they read a corpus path | |
| # that CI does not have. See tests/corpus.py. | |
| run: pytest -q --tb=short | |
| - name: Build the distribution | |
| run: | | |
| python -m pip install --upgrade build | |
| rm -rf dist build *.egg-info | |
| python -m build | |
| - name: Release guards | |
| # Runs from the repo root, which is exactly the case the guard had to | |
| # be hardened against -- cwd on sys.path made an earlier version | |
| # validate the working tree instead of the built wheel. | |
| run: python scripts/check_release.py dist/ | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist | |
| path: dist/ | |
| publish: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| environment: pypi | |
| permissions: | |
| id-token: write # Trusted Publishing; no token secret required | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: dist | |
| path: dist/ | |
| - uses: pypa/gh-action-pypi-publish@release/v1 |