python-publish.yml

# This workflow will upload a Python Package using Twine when a release is created
# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries

name: PyPI Package

on:
  release:
    types: [published]
  workflow_dispatch:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

jobs:
  pypi_upload:

    name: Upload release to PyPI
    runs-on: ${{ vars.UBUNTU_RUNNER || 'ubuntu-latest' }}
    environment:
      name: pypi
      url: https://pypi.org/p/ardupilot_methodic_configurator
    permissions:
      id-token: write

    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
      with:
        egress-policy: audit

    - name: Checkout
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    # https://docs.astral.sh/uv/guides/integration/github/
    - name: Install uv and set the python version
      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
      with:
        python-version: '3.14'
        activate-environment: true

    - name: Install dependencies
      run: |
        # Read pypi_dist from pyproject.toml and install those packages with uv
        PKGS="$(python scripts/list_pypi_build_dependencies.py)"
        if [ -n "$PKGS" ]; then
          uv pip install $PKGS
        else
          echo "No pypi_dist entries found in pyproject.toml; skipping install"
        fi

    - name: Build package
      run: python -m build --report build-report.json

    - name: Verify wheel plugin and log-analysis modules
      run: python scripts/verify_packaged_modules.py dist/*.whl

    - name: Verify release wheel installation and SHA256
      run: python scripts/verify_wheel_install.py --build-report build-report.json

    - name: Verify package build report
      run: |
        python - <<'PY'
        import hashlib
        import json
        from pathlib import Path

        report = json.loads(Path("build-report.json").read_text())
        assert {artifact["kind"] for artifact in report["artifacts"]} == {"sdist", "wheel"}
        for artifact in report["artifacts"]:
            path = Path(artifact["path"])
            assert path.is_file(), path
            digest = hashlib.sha256(path.read_bytes()).hexdigest()
            assert digest == artifact["hashes"]["sha256"], artifact
            print(f"Verified {artifact['name']} ({digest})")
        PY

    - name: Publish package distributions to PyPI
      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2