pypi-publish.yml

name: Publish to PyPI

on:
  workflow_dispatch:
    inputs:
      run_id:
        description: The run of wheel-builder to use for finding artifacts.
        required: true
      environment:
        description: Which PyPI environment to upload to
        required: true
        type: choice
        options: ["testpypi", "pypi"]
  workflow_run:
    workflows: ["Wheel Builder"]
    types: [completed]

env:
  PUBLISH_REQUIREMENTS_PATH: .github/requirements/publish-requirements.txt

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    # We're not actually verifying that the triggering push event was for a
    # tag, because github doesn't expose enough information to do so.
    # wheel-builder.yml currently only has push events for tags.
    if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success')
    permissions:
      id-token: "write"
    steps:
      - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
        with:
          python-version: "3.11"
      - name: Get publish-requirements.txt from repository
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          sparse-checkout: |
            ${{ env.PUBLISH_REQUIREMENTS_PATH }}
          sparse-checkout-cone-mode: false
          persist-credentials: false
      - name: Install Python dependencies
        run: pip install --require-hashes -r ${{ env.PUBLISH_REQUIREMENTS_PATH }}

      - uses: dawidd6/action-download-artifact@268677152d06ba59fcec7a7f0b5d961b6ccd7e1e # v2.28.0
        with:
          path: dist/
          run_id: ${{ github.event.inputs.run_id || github.event.workflow_run.id }}

      - run: |
          echo "OIDC_AUDIENCE=pypi" >> $GITHUB_ENV
          echo "PYPI_DOMAIN=pypi.org" >> $GITHUB_ENV
          echo "TWINE_REPOSITORY=pypi" >> $GITHUB_ENV
          echo "TWINE_USERNAME=__token__" >> $GITHUB_ENV
        if: github.event_name == 'workflow_run' || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'pypi')
      - run: |
          echo "OIDC_AUDIENCE=testpypi" >> $GITHUB_ENV
          echo "PYPI_DOMAIN=test.pypi.org" >> $GITHUB_ENV
          echo "TWINE_REPOSITORY=testpypi" >> $GITHUB_ENV
          echo "TWINE_USERNAME=__token__" >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'testpypi'

      - run: |
          import os

          import requests

          response = requests.get(
              os.environ["ACTIONS_ID_TOKEN_REQUEST_URL"],
              params={"audience": os.environ["OIDC_AUDIENCE"]},
              headers={"Authorization": f"bearer {os.environ['ACTIONS_ID_TOKEN_REQUEST_TOKEN']}"}
          )
          response.raise_for_status()
          token = response.json()["value"]

          response = requests.post(f"https://{os.environ['PYPI_DOMAIN']}/_/oidc/github/mint-token", json={"token": token})
          response.raise_for_status()
          pypi_token = response.json()["token"]

          with open(os.environ["GITHUB_ENV"], "a") as f:
              print(f"::add-mask::{pypi_token}")
              f.write(f"TWINE_PASSWORD={pypi_token}\n")
        shell: python

      - run: twine upload --skip-existing $(find dist/ -type f -name 'cryptography*')

      # Do not perform sigstore signatures for things for TestPyPI. This is
      # because there's nothing that would prevent a malicious PyPI from
      # serving a signed TestPyPI asset in place of a release intended for
      # PyPI.
      - run: sigstore sign $(find dist/ -type f -name 'cryptography*')
        if: env.TWINE_REPOSITORY == 'pypi'