russell@unturf.com
6f05f7eef4
twine 6 (Sep 2025) auto-detects GitLab CI envvars and refuses to fall back to ~/.pypirc on the runner, requiring PYPI_ID_TOKEN (Trusted Publishing OIDC) instead. Pipeline #40338 (v0.1.0 tag) hit this and failed with TrustedPublishingFailure. Pinning twine<6 restores classic ~/.pypirc auth that ago / make_post_sell / remarkbox already use on the same runner. When we migrate to Trusted Publishing as a coordinated change across all four python/* repos, we'll drop this pin and add an id_tokens block + PyPI trusted-publisher config.
49 lines
1.8 KiB
YAML
49 lines
1.8 KiB
YAML
stages:
|
|
- test
|
|
- pypi-twine
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Tests run on every push to any branch.
|
|
#
|
|
# Live-integration tests need EPMD on the runner — ``make all`` skips
|
|
# them automatically when EPMD isn't reachable. CI runners typically
|
|
# don't run EPMD, so we get unit-level coverage in CI and full
|
|
# integration coverage on the dev machine.
|
|
# ---------------------------------------------------------------------------
|
|
test:
|
|
stage: test
|
|
tags: ["build"]
|
|
script:
|
|
- python3 -m venv .venv
|
|
- . .venv/bin/activate
|
|
- pip install --upgrade pip wheel
|
|
- pip install -e ".[dev]"
|
|
- pytest -v
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Ship to PyPI on tag pushes.
|
|
#
|
|
# Tag the commit (``git tag -a v0.0.1 -m 'release'`` then
|
|
# ``git push --tags``) and CI builds sdist + wheel and uploads with
|
|
# twine. Credentials come from GitLab CI variables ``TWINE_USERNAME``
|
|
# (typically ``__token__``) and ``TWINE_PASSWORD`` (the PyPI API token).
|
|
# ---------------------------------------------------------------------------
|
|
pypi-twine:
|
|
stage: pypi-twine
|
|
tags: ["build"]
|
|
only:
|
|
- tags
|
|
script:
|
|
- python3 -m venv .venv
|
|
- . .venv/bin/activate
|
|
- pip install --upgrade pip
|
|
# Pin twine <6 — newer twine auto-detects GitLab CI and refuses to
|
|
# fall back to ~/.pypirc on the runner, requiring PYPI_ID_TOKEN
|
|
# (Trusted Publishing OIDC) instead. Until we migrate all four
|
|
# python/* repos to Trusted Publishing in one coordinated change,
|
|
# stick with the classic ~/.pypirc path that ago / make_post_sell /
|
|
# remarkbox already use.
|
|
- pip install build "twine<6"
|
|
- python -m build
|
|
- twine check dist/*
|
|
- twine upload --non-interactive dist/*
|