russell@unturf.com
dee08976ef
Trusted Publishing OIDC is blocked for git.unturf.com — PyPI's GitLab
provider hardcodes the issuer to gitlab.com (no self-hosted instance
field in the Add publisher form). Until PyPI lights up self-hosted
GitLab support, classic API token auth is our path.
Auth source: TWINE_USERNAME=__token__ + TWINE_PASSWORD=<pypi-...> set
as group-level CI variables on python/. Both python/ago and
python/erldistpy inherit them automatically; engineering/ group gets
the same vars for make-post-sell + remarkbox.
What this commit changes:
- .gitlab-ci.yml pypi-twine stage drops the id_tokens block we
briefly tried (OIDC), uses latest twine (no <6 pin) — twine 6
reads TWINE_USERNAME/TWINE_PASSWORD env vars and prefers them
over the OIDC attempt
- pyproject.toml build-system requires drops the setuptools<77
cap (latest setuptools emits Metadata-Version 2.4 which twine 6
reads fine; locally verified)
- docs/PYPI-TRUSTED-PUBLISHING.md updated to note the issuer-
hardcoded blocker and the recipe to migrate later when it
unblocks (or if we mirror to gitlab.com)
49 lines
1.6 KiB
YAML
49 lines
1.6 KiB
YAML
stages:
|
|
- test
|
|
- pypi-twine
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Tests run on every push to any branch.
|
|
#
|
|
# Live-integration tests need EPMD on the runner — ``make all`` skips
|
|
# them automatically when EPMD isn't reachable. CI runners typically
|
|
# don't run EPMD, so we get unit-level coverage in CI and full
|
|
# integration coverage on the dev machine.
|
|
# ---------------------------------------------------------------------------
|
|
test:
|
|
stage: test
|
|
tags: ["build"]
|
|
except:
|
|
- tags
|
|
script:
|
|
- python3 -m venv .venv
|
|
- . .venv/bin/activate
|
|
- pip install --upgrade pip wheel
|
|
- pip install -e ".[dev]"
|
|
- pytest -v
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Ship to PyPI on tag pushes.
|
|
#
|
|
# Auth: TWINE_USERNAME + TWINE_PASSWORD env vars come from project-scoped
|
|
# GitLab CI variables (Settings → CI/CD → Variables, masked + protected).
|
|
# Standard values: TWINE_USERNAME=__token__ and TWINE_PASSWORD=<pypi-...>.
|
|
#
|
|
# Trusted Publishing OIDC would be cleaner but PyPI's GitLab provider is
|
|
# hardcoded to gitlab.com — git.unturf.com self-hosted isn't supported.
|
|
# See docs/PYPI-TRUSTED-PUBLISHING.md for the migration recipe whenever
|
|
# PyPI adds custom-issuer support (or whenever we mirror to gitlab.com).
|
|
# ---------------------------------------------------------------------------
|
|
pypi-twine:
|
|
stage: pypi-twine
|
|
tags: ["build"]
|
|
only:
|
|
- tags
|
|
script:
|
|
- python3 -m venv .venv
|
|
- . .venv/bin/activate
|
|
- pip install --upgrade pip
|
|
- pip install build twine
|
|
- python -m build
|
|
- twine check dist/*
|
|
- twine upload --non-interactive dist/*
|