pyblock/.github/workflows/python-publish.yml
GaltRanch 9886c66d4e Harden GitHub Actions workflow security
- Replace pipe-to-shell Poetry install with download-then-execute pattern
- Remove --password flag that exposed PyPI token in logs
- Use POETRY_PYPI_TOKEN_PYPI env var instead (Poetry reads it natively)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-01 11:59:47 -03:00

82 lines
2 KiB
YAML

# This workflow will upload a Python Package using Twine when a release is created
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
name: Publish Python Package
on:
push:
tags:
- 'v*.*.*'
jobs:
test:
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Install Poetry
run: |
curl -sSL https://install.python-poetry.org -o install-poetry.py
python3 install-poetry.py --version 1.8.3
rm install-poetry.py
- name: Configure Poetry
run: |
poetry config virtualenvs.in-project true
- name: Install dependencies
run: |
poetry install
- name: Run tests
run: |
poetry run pytest
build:
runs-on: ubuntu-latest
needs: test
steps:
- name: Check out repository
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Install Poetry
run: |
curl -sSL https://install.python-poetry.org -o install-poetry.py
python3 install-poetry.py --version 1.8.3
rm install-poetry.py
- name: Configure Poetry
run: |
poetry config virtualenvs.in-project true
- name: Install dependencies
run: |
poetry install
- name: Build package
run: |
poetry build
- name: Publish package to PyPI
env:
POETRY_PYPI_TOKEN_PYPI: ${{ secrets.PYPI_API_TOKEN }}
run: |
poetry publish --no-interaction