Merge pull request #55 from rcolfin/validate-release

Adding a validation step when python-publish runs to ensure that the …
GitBib · Dec 16, 2024 · c257daf · c257daf
2 parents b3e1883 + 25a4f2d
commit c257daf
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 3 deletions.
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -24,7 +24,7 @@ jobs:
       - name: Install Poetry
         uses: snok/install-poetry@v1
         with:
-          version: 1.8.3
+          version: latest
           virtualenvs-create: true
           virtualenvs-in-project: true
           installer-parallel: true

diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
@@ -11,14 +11,22 @@ jobs:
     steps:
     - name: Check out repository
       uses: actions/checkout@v4
+    - name: Get the tag name for the release
+      id: vars
+      shell: bash
+      run: |
+          tag="${GITHUB_REF#refs/*/}"  # refs/tags/1.2.3 -> 1.2.3
+          echo "tag=$tag" >> $GITHUB_OUTPUT
+    - run: |
+        echo "tag=${{ steps.vars.outputs.tag }}"
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
         python-version: '3.11'
     - name: Install Poetry
       uses: snok/install-poetry@v1
       with:
-        version: 1.8.3
+        version: latest
         virtualenvs-create: true
         virtualenvs-in-project: true
         installer-parallel: true
@@ -33,8 +41,17 @@ jobs:
       run: poetry install --no-interaction --no-root --no-dev
     - name: Install project
       run: poetry install --no-interaction
-    - name: publish
+    - name: Validate Release Version
+      shell: bash
+      run: |
+        set -euo pipefail
+        VERSION=$(poetry version --short)
+        [ "${VERSION}" == "${TAG}" ] || { >&2 echo "Expected ${TAG} got ${VERSION}"; exit 1; }
+      env:
+        TAG: ${{ steps.vars.outputs.tag }}
+    - name: Publish
       shell: bash
       run: |
+        set -euo pipefail
         poetry config pypi-token.pypi ${{ secrets.PYPI_TOKEN }}
         poetry publish --build --no-interaction