Merge pull request #418 from openquantumhardware/dependabot/github_ac… #197
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build a wheel and publish to PyPI when a pull request merges. | |
| # https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ | |
| # | |
| # Based on https://github.com/orgs/community/discussions/26724#discussioncomment-3253102 we trigger this workflow on a push to main branch, and protect the main branch. | |
| # | |
| # We previously used the pull_request_target workflow trigger, but it seems that since sometime between January and March 2026 this no longer works with trusted publishing. | |
| # How that used to work: | |
| # | |
| # We need access to the repo secrets, which are only available using the pull_request_target trigger. | |
| # For security this requires us to use the repo HEAD and not the PR merge commit. | |
| # But since this action only executes on merge, those are the same thing. | |
| # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target | |
| name: Build wheel | |
| on: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.x" | |
| - name: Build wheel | |
| run: | | |
| python -m pip install --user --upgrade pip build wheel | |
| python -m build | |
| - name: Store the distribution packages | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: python-package-distributions | |
| path: dist/ | |
| publish-to-pypi: | |
| needs: | |
| - build | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: release | |
| url: https://pypi.org/p/qick | |
| permissions: | |
| # IMPORTANT: this permission is mandatory for trusted publishing | |
| id-token: write | |
| steps: | |
| - name: Download all the dists | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: python-package-distributions | |
| path: dist/ | |
| - name: Publish distribution to PyPI | |
| uses: pypa/gh-action-pypi-publish@release/v1 |