kapitan 0.35.2.dev21__tar.gz → 0.35.2.dev22__tar.gz

kapitan-0.35.2.dev22/.github/workflows/pex-build-upload.yml

@@ -0,0 +1,91 @@
+---
+name: PEX Build and Upload
+
+on:
+  workflow_dispatch:
+  workflow_run:
+    workflows:
+      - Publish Python Package to PyPI
+    types:
+      - completed
+
+jobs:
+  pex_build_publish:
+    runs-on: ubuntu-latest
+    # For workflow_run: only run when the upstream PyPI publish succeeded.
+    # For workflow_dispatch: always run (manual trigger).
+    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    permissions:
+      # Required for softprops/action-gh-release to upload PEX + checksum
+      # assets to the GitHub release page. Only actually used when the tag
+      # upload condition below evaluates to true (release tags only).
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Determine release tag
+        id: tag
+        run: |
+          # For workflow_run, github.ref is the default branch — derive the tag
+          # from the triggering workflow's head branch instead.
+          # For workflow_dispatch, use GITHUB_REF_NAME directly.
+          if [ "${{ github.event_name }}" = "workflow_run" ]; then
+            TAG="${{ github.event.workflow_run.head_branch }}"
+          else
+            TAG="${GITHUB_REF_NAME}"
+          fi
+          echo "name=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "Release tag: ${TAG}"
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: |
+            3.10
+            3.11
+            3.12
+            3.13
+            3.14
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Install libraries dependencies
+        run: |
+          uv pip compile \
+            --all-extras \
+            --format=requirements.txt \
+            --output-file=requirements.txt \
+            pyproject.toml
+      - name: Set up Go
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version: 1.17
+      - name: Build Pex
+        run: |-
+          mkdir -p dist
+          uvx pex '.[gojsonnet,omegaconf,reclass-rs]' -r requirements.txt \
+            --python-shebang='#!/usr/bin/env python3' \
+            --python=python3.11 \
+            --python=python3.10 \
+            --python=python3.12 \
+            --python=python3.13 \
+            --python=python3.14 \
+            -m kapitan \
+            -o dist/kapitan.linux-x86_64.pex
+          dist/kapitan.linux-x86_64.pex --help
+
+      - name: Generate PEX checksum
+        run: |
+          (cd dist && sha256sum kapitan.linux-x86_64.pex) > dist/kapitan.linux-x86_64.pex.sha256
+          echo "PEX checksum:"
+          cat dist/kapitan.linux-x86_64.pex.sha256
+          (cd dist && sha256sum -c kapitan.linux-x86_64.pex.sha256)
+
+      - name: Add linux-x86_64 pex to assets
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        if: >-
+          (github.event_name == 'workflow_run' && startsWith(github.event.workflow_run.head_branch, 'v')) ||
+          startsWith(github.ref, 'refs/tags/')
+        with:
+          tag_name: ${{ steps.tag.outputs.name }}
+          files: |
+            dist/kapitan.linux-x86_64.pex
+            dist/kapitan.linux-x86_64.pex.sha256

kapitan-0.35.2.dev22/.github/workflows/python-pypi-publish.yml

@@ -0,0 +1,78 @@
+---
+name: Publish Python Package to PyPI
+
+concurrency:
+  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  release:
+    types: [created]
+
+jobs:
+  pypi-publish:
+    runs-on: ubuntu-latest
+    permissions:
+      # Required for softprops/action-gh-release to upload SBOM + checksum
+      # assets to the GitHub release page. Only actually used when the
+      # "Upload release artifacts" step runs (release events only).
+      contents: write
+      # NOTE:
+      # Remove user/password and uncomment id-token permission once Trusted
+      # Publishing (OIDC) is setup in pypi. See:
+      # https://github.com/pypa/gh-action-pypi-publish
+      # id-token: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          submodules: recursive
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: pyproject.toml
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Build and check
+        run: |
+          uv build
+          uvx twine check dist/*
+      - name: Extract version
+        id: version
+        run: |
+          # On release events, use the tag name (stripping any leading 'v').
+          # On workflow_dispatch, fall back to parsing the built wheel filename
+          # (kapitan is not installed in the runner Python after `uv build`).
+          if [ "${{ github.event_name }}" = "release" ]; then
+            VERSION="${GITHUB_REF_NAME#v}"
+          else
+            VERSION=$(python3 -c "import glob, re, sys; m=re.search(r'kapitan-([^-]+)-', glob.glob('dist/kapitan-*.whl')[0]); print(m.group(1)) if m else sys.exit('no wheel found')")
+          fi
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "Detected version: ${VERSION}"
+      - name: Generate SBOM
+        timeout-minutes: 10
+        run: |
+          scripts/generate_sbom.sh "${{ steps.version.outputs.version }}" dist
+      - name: Generate SHA256 checksums
+        timeout-minutes: 5
+        run: |
+          scripts/generate_checksums.sh dist dist/SHA256SUMS
+      - name: Validate checksums
+        timeout-minutes: 5
+        run: |
+          (cd dist && sha256sum -c SHA256SUMS)
+      - name: Upload release artifacts
+        if: github.event_name == 'release'
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        with:
+          files: |
+            dist/kapitan-*.whl
+            dist/kapitan-*.tar.gz
+            dist/kapitan-${{ steps.version.outputs.version }}.python.sbom.cdx.json
+            dist/SHA256SUMS
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        with:
+          user: __token__
+          password: ${{ secrets.PYPI_TOKEN }}

{kapitan-0.35.2.dev21 → kapitan-0.35.2.dev22}/.github/workflows/test-build-publish.yml

@@ -161,6 +161,8 @@ jobs:
     name: build ${{ matrix.platform.platform }} image using python ${{ matrix.python-version }}
     needs: [setup, precommit, test, check-changes]
     runs-on: ${{ matrix.platform.runner }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -218,6 +220,9 @@ jobs:
             type=semver,pattern={{major}},suffix=${{ steps.suffix.outputs.python-suffix }}${{ steps.suffix.outputs.platform-suffix }}
           flavor: |
             latest=false
+          labels: |
+            io.kapitan.sbom.format=CycloneDX
+            io.kapitan.sbom.spec-version=1.6
 
       # For default python version, also create tags with -py suffix for compatibility
       - name: Docker meta (py-suffixed tags for default version)
@@ -267,6 +272,54 @@ jobs:
         run: |
           docker run -t --rm local-test --version
 
+      - name: Set up uv
+        if: github.event_name != 'pull_request'
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+
+      - name: Generate Docker SBOM
+        id: docker-sbom
+        if: github.event_name != 'pull_request'
+        timeout-minutes: 10
+        run: |
+          mkdir -p dist
+          PLATFORM_SLUG=$(echo "${{ matrix.platform.platform }}" | tr '/' '-')
+          # On release events use the tag; otherwise fall back to a short SHA so
+          # the artifact filename is still unique and traceable.
+          if [ "${{ github.event_name }}" = "release" ]; then
+            VERSION="${GITHUB_REF_NAME#v}"
+          else
+            VERSION="${GITHUB_SHA::8}"
+          fi
+          SBOM_FILE="dist/kapitan-${VERSION}-py${{ matrix.python-version }}-${PLATFORM_SLUG}-docker.sbom.cdx.json"
+          # Generate SBOM from production+extras deps via uv export.
+          # --all-extras matches the Docker image which installs gojsonnet/omegaconf/reclass-rs.
+          # --no-group test/docs prevents dev tooling from contaminating the SBOM.
+          uv export \
+              --no-dev --no-group test --no-group docs \
+              --all-extras --no-editable \
+              --format requirements-txt --no-hashes | \
+            grep -Ev '^[[:space:]]*(#|\.[[:space:]]*$|$)' | \
+            uvx --from 'cyclonedx-bom>=4,<5' cyclonedx-py requirements \
+              --mc-type application \
+              --of JSON \
+              --output-reproducible \
+              -o "${SBOM_FILE}" -
+          echo "sbom-file=${SBOM_FILE}" >> "$GITHUB_OUTPUT"
+          echo "platform-slug=${PLATFORM_SLUG}" >> "$GITHUB_OUTPUT"
+          echo "Docker SBOM generated: ${SBOM_FILE}"
+
+      - name: Validate Docker SBOM
+        if: github.event_name != 'pull_request'
+        run: scripts/validate_sbom.sh "${{ steps.docker-sbom.outputs.sbom-file }}"
+
+      - name: Upload Docker SBOM artifact
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: docker-sbom-py${{ matrix.python-version }}-${{ steps.docker-sbom.outputs.platform-slug }}
+          path: ${{ steps.docker-sbom.outputs.sbom-file }}
+          retention-days: 1
+
       - name: Push image to DockerHub
         env:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -281,6 +334,35 @@ jobs:
           build-args: |
             PYTHON_VERSION=${{ matrix.python-version }}
 
+  upload-docker-sboms:
+    name: upload Docker SBOMs to release
+    needs: [setup, build]
+    if: github.event_name == 'release'
+    runs-on: ${{ needs.setup.outputs.runner }}
+    permissions:
+      contents: write
+    steps:
+      - name: Download Docker SBOM artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: docker-sbom-*
+          merge-multiple: true
+          path: dist/sboms
+
+      - name: Verify SBOMs were downloaded
+        run: |
+          count=$(find dist/sboms -name '*.sbom.cdx.json' -type f | wc -l)
+          echo "Found ${count} Docker SBOM(s)"
+          if [ "${count}" -eq 0 ]; then
+            echo "ERROR: no Docker SBOMs downloaded; build artifacts may have expired (retention=1 day)." >&2
+            exit 1
+          fi
+
+      - name: Upload Docker SBOMs to release
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        with:
+          files: dist/sboms/*.sbom.cdx.json
+
   build-multi-architecture:
     name: combine platform images for python ${{ matrix.python-version }}
     needs:

{kapitan-0.35.2.dev21 → kapitan-0.35.2.dev22}/.pre-commit-config.yaml

@@ -13,6 +13,11 @@ repos:
     hooks:
       - id: end-of-file-fixer
       - id: check-merge-conflict
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.10.0.1
+    hooks:
+      - id: shellcheck
+        args: [--severity=warning]
   - repo: https://github.com/rhysd/actionlint
     rev: 'v1.7.7'
     hooks:

{kapitan-0.35.2.dev21 → kapitan-0.35.2.dev22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kapitan
-Version: 0.35.2.dev21
+Version: 0.35.2.dev22
 Summary: Generic templated configuration management for Kubernetes, Terraform and other things
 Project-URL: Homepage, https://kapitan.dev
 Project-URL: Repository, https://github.com/kapicorp/kapitan

{kapitan-0.35.2.dev21 → kapitan-0.35.2.dev22}/scripts/after_deploy.sh

@@ -7,7 +7,7 @@ notify_slack() {
     return 0
   fi
 
-  curl -s --retry 3 --retry-delay 3 -X POST --data-urlencode 'payload={"text": "'"$1"'"}' ${SLACK_WEBHOOK} > /dev/null
+  curl -s --retry 3 --retry-delay 3 -X POST --data-urlencode 'payload={"text": "'"$1"'"}' "${SLACK_WEBHOOK}" > /dev/null
 }
 
 notify_hangouts() {
@@ -15,10 +15,11 @@ notify_hangouts() {
     return 0
   fi
 
-  curl -s --retry 3 --retry-delay 3 -H 'Content-Type: application/json' -X POST -d '{"text": "'"$1"'"}' ${HANGOUTS_WEBHOOK} > /dev/null
+  curl -s --retry 3 --retry-delay 3 -H 'Content-Type: application/json' -X POST -d '{"text": "'"$1"'"}' "${HANGOUTS_WEBHOOK}" > /dev/null
 }
 
-export LATEST_TAG=$(git describe --abbrev=0 --tags)
+LATEST_TAG=$(git describe --abbrev=0 --tags)
+export LATEST_TAG
 MSG="Succesfully deployed ${LATEST_TAG} on Kapitan. https://github.com/kapicorp/kapitan/releases/tag/${LATEST_TAG}"
 notify_slack "${MSG}"
 notify_hangouts "${MSG}"

kapitan-0.35.2.dev22/scripts/generate_checksums.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Generate SHA256SUMS for release artifacts.
+#
+# Usage: generate_checksums.sh <artifacts_dir> [output_file]
+#
+# Scans <artifacts_dir> for kapitan wheels, sdists, and SBOMs, then writes
+# standard sha256sum-format entries to <output_file>.
+# Defaults output_file to <artifacts_dir>/SHA256SUMS.
+#
+# Note: this script covers Python package artifacts only (wheel, sdist, SBOM).
+# The PEX binary checksum is written to SHA256SUMS.pex by the PEX build workflow.
+# Docker image SBOMs are uploaded as separate named assets without a shared manifest.
+
+set -euo pipefail
+
+ARTIFACTS_DIR="${1:?Usage: $0 <artifacts_dir> [output_file]}"
+OUTPUT_FILE="${2:-${ARTIFACTS_DIR}/SHA256SUMS}"
+
+echo "=== Generating SHA256 checksums in ${ARTIFACTS_DIR} ==="
+
+ARTIFACT_FILES=()
+while IFS= read -r -d '' file; do
+    ARTIFACT_FILES+=("$(basename "${file}")")
+done < <(find "${ARTIFACTS_DIR}" -maxdepth 1 \
+    \( -name "kapitan-*.whl" \
+    -o -name "kapitan-*.tar.gz" \
+    -o -name "kapitan-*.python.sbom.cdx.json" \
+    \) -print0 | sort -z)
+
+if [[ ${#ARTIFACT_FILES[@]} -eq 0 ]]; then
+    echo "ERROR: No artifacts found in ${ARTIFACTS_DIR}" >&2
+    exit 1
+fi
+
+(
+    cd "${ARTIFACTS_DIR}"
+    sha256sum "${ARTIFACT_FILES[@]}"
+) > "${OUTPUT_FILE}"
+
+echo "Checksums written to: ${OUTPUT_FILE}"
+cat "${OUTPUT_FILE}"

kapitan-0.35.2.dev22/scripts/generate_sbom.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Generate a CycloneDX SBOM JSON for the kapitan Python package release.
+#
+# Usage: generate_sbom.sh <version> [output_dir]
+#
+# Must be run from the repository root (pyproject.toml must be present in $PWD).
+# Exports the maximal supported install (production deps + all optional extras)
+# via uv and generates a CycloneDX JSON SBOM using cyclonedx-py.
+# The tool validates the output against the CycloneDX schema by default.
+#
+# Output filename: kapitan-${VERSION}.python.sbom.cdx.json
+# The ".python." infix distinguishes this from the per-platform Docker image
+# SBOMs which are named kapitan-${VERSION}-py<X>-<platform>-docker.sbom.cdx.json.
+
+set -euo pipefail
+
+VERSION="${1:?Usage: $0 <version> [output_dir]}"
+OUTPUT_DIR="${2:-dist}"
+OUTPUT_FILE="${OUTPUT_DIR}/kapitan-${VERSION}.python.sbom.cdx.json"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+echo "=== Generating SBOM for kapitan ${VERSION} ==="
+
+REQUIREMENTS_FILE="$(mktemp /tmp/kapitan-requirements-XXXXXX.txt)"
+TMP_RAW="$(mktemp /tmp/kapitan-requirements-raw-XXXXXX.txt)"
+trap 'rm -f "${REQUIREMENTS_FILE}" "${TMP_RAW}"' EXIT
+
+# Export production deps + all optional extras.
+# --no-dev:           exclude the 'dev' dependency group
+# --no-group test:    exclude the 'test' dependency group
+# --no-group docs:    exclude the 'docs' dependency group
+# --all-extras:       include gojsonnet/omegaconf/reclass-rs (PEP 621 extras)
+# --no-editable:      strip the editable self-reference (-e .)
+
+uv export \
+    --no-dev \
+    --no-group test \
+    --no-group docs \
+    --all-extras \
+    --no-editable \
+    --format requirements-txt \
+    --no-hashes \
+    --output-file "${TMP_RAW}"
+
+# Strip comments, blank lines, and the bare '.' self-reference (left behind
+# by `uv export --no-editable`) so cyclonedx-py does not warn about an
+# unpinned 'unknown' component for the project itself.
+grep -Ev '^[[:space:]]*(#|\.[[:space:]]*$|$)' "${TMP_RAW}" > "${REQUIREMENTS_FILE}"
+
+echo "Exported $(wc -l < "${REQUIREMENTS_FILE}") dependency lines"
+
+# Generate CycloneDX SBOM from requirements.
+# cyclonedx-bom is pinned to >=4,<5 to prevent silent CLI breakage on major bumps.
+# --validate (default=on) checks the output against the CycloneDX schema.
+# --output-reproducible strips timestamps/random UUIDs for deterministic output.
+# Note: --pyproject is intentionally omitted; it crashes cyclonedx-bom 4.x
+#       (observed in 4.6.1 with "'str' object has no attribute 'get'").
+#       Re-evaluate when bumping to cyclonedx-bom 5.x.
+uvx --from 'cyclonedx-bom>=4,<5' cyclonedx-py requirements \
+    --mc-type application \
+    --of JSON \
+    --output-reproducible \
+    -o "${OUTPUT_FILE}" \
+    "${REQUIREMENTS_FILE}"
+
+echo "SBOM written to: ${OUTPUT_FILE}"
+
+"${SCRIPT_DIR}/validate_sbom.sh" "${OUTPUT_FILE}"

{kapitan-0.35.2.dev21 → kapitan-0.35.2.dev22}/scripts/inc_version.sh

@@ -6,9 +6,10 @@ echomsg() {
   echo "--- ${1} ---"
 }
 
-export LAST_COMMIT_MSG="$(git log -1 --oneline)"
+LAST_COMMIT_MSG="$(git log -1 --oneline)"
+export LAST_COMMIT_MSG
 
-if ! $(echo "$LAST_COMMIT_MSG" | grep -qE "kapicorp/release-v([0-9]+.[0-9]{2}.[0-9]+)+" ); then
+if ! echo "$LAST_COMMIT_MSG" | grep -qE "kapicorp/release-v([0-9]+.[0-9]{2}.[0-9]+)+"; then
   echomsg "Not a release, skipping version incrementing"
   exit 0;
 fi
@@ -37,7 +38,7 @@ git commit -m "Version increment $VERSION"
 git tag -a "v$VERSION" -m "Version increment $VERSION"
 
 git remote remove origin
-git remote add origin https://${GH_TOKEN}@github.com/kapicorp/kapitan.git
+git remote add origin "https://${GH_TOKEN}@github.com/kapicorp/kapitan.git"
 
 echomsg "Push new commit and tag v$VERSION"
 git push origin --tags HEAD:master

kapitan-0.35.2.dev22/scripts/validate_sbom.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Validate a CycloneDX SBOM JSON file.
+#
+# Usage: validate_sbom.sh <sbom_file>
+#
+# Exits non-zero if the file is missing, not valid JSON, or does not have
+# bomFormat == "CycloneDX". Reports component count on success.
+
+set -euo pipefail
+
+SBOM_FILE="${1:?Usage: $0 <sbom_file>}"
+
+python3 -c "
+import json, sys
+sbom_file = sys.argv[1]
+with open(sbom_file) as f:
+    data = json.load(f)
+bom_format = data.get('bomFormat', '<missing>')
+if bom_format != 'CycloneDX':
+    print(f'ERROR: unexpected bomFormat: {bom_format}', file=sys.stderr)
+    sys.exit(1)
+component_count = len(data.get('components', []))
+print(f'SBOM validation: OK (file={sbom_file}, bomFormat={bom_format}, components={component_count})')
+" "${SBOM_FILE}"

kapitan-0.35.2.dev21/.github/workflows/pex-build-upload.yml

@@ -1,57 +0,0 @@
----
-name: PEX Build and Upload
-
-on:
-  workflow_dispatch:
-  workflow_run:
-    workflows:
-      - Upload Python Package
-    types:
-      - completed
-
-jobs:
-  pex_build_publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: |
-            3.10
-            3.11
-            3.12
-            3.13
-            3.14
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install libraries dependencies
-        run: |
-          uv pip compile \
-            --all-extras \
-            --format=requirements.txt \
-            --output-file=requirements.txt \
-            pyproject.toml
-      - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
-        with:
-          go-version: 1.17
-      - name: Build Pex
-        run: |-
-          mkdir -p dist
-          uvx pex '.[gojsonnet,omegaconf,reclass-rs]' -r requirements.txt \
-            --python-shebang='#!/usr/bin/env python3' \
-            --python=python3.11 \
-            --python=python3.10 \
-            --python=python3.12 \
-            --python=python3.13 \
-            --python=python3.14 \
-            -m kapitan \
-            -o dist/kapitan.linux-x86_64.pex
-          dist/kapitan.linux-x86_64.pex --help
-
-      - name: Add linux-x86_64 pex to assets
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
-        if: startsWith(github.ref, 'refs/tags/')
-        with:
-          files: dist/kapitan.linux-x86_64.pex

kapitan-0.35.2.dev21/.github/workflows/python-pypi-publish.yml

@@ -1,41 +0,0 @@
----
-name: Publish Python Package to PyPI
-
-concurrency:
-  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
-  cancel-in-progress: true
-
-on:
-  workflow_dispatch:
-  release:
-    types: [created]
-
-jobs:
-  pypi-publish:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      # NOTE:
-      # Remove user/password and uncomment id-token permission once Trusted
-      # Publishing (OIDC) is setup in pypi. See:
-      # https://github.com/pypa/gh-action-pypi-publish
-      # id-token: write
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          submodules: recursive
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version-file: pyproject.toml
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Build and check
-        run: |
-          uv build
-          uvx twine check dist/*
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_TOKEN }}