Remove release on test PyPI, OIDC auth, fix release tag (#18)

.github/set-version

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+
+
+import argparse
+import io
+import os
+
+GIT_REF_PREFIX = "refs/tags/"
+
+
+def github_ref_type(value: str) -> str:
+    if not value.startswith(GIT_REF_PREFIX):
+        raise ValueError("Invalid GITHUB_REF format, expects `refs/tags/<tag name>`")
+
+    return value
+
+
+def write_about_file(file: io.TextIOWrapper, git_ref: str) -> None:
+    tag = git_ref[len(GIT_REF_PREFIX) :]
+    value = f'__version__ = "{tag}"'
+    print(value, file=file)
+    return tag
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "GITHUB_REF",
+        default=os.environ.get("GITHUB_REF"),
+        type=github_ref_type,
+        help=(
+            'The Git reference, like "refs/tags/<tag name>". '
+            "Read automatically the GITHUB_REF environment variable, if possible."
+        ),
+    )
+    parser.add_argument(
+        "-f",
+        "--filename",
+        default="structlog_gcp/__about__.py",
+        type=argparse.FileType("w"),
+        help="The file to write the version into.",
+    )
+    args = parser.parse_args()
+
+    write_about_file(args.filename, args.GITHUB_REF)
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/build-test-release.yml

@@ -1,4 +1,4 @@
-name: Build & maybe upload PyPI package
+name: Build & test
 
 on:
   push:
@@ -9,15 +9,8 @@ on:
     branches:
       - main
 
-  release:
-    types:
-      - published
-
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   build:
     name: Build & verify package
@@ -35,6 +28,10 @@ jobs:
       - name: Setup Hatch
         run: pipx install hatch
 
+      - name: Configure version
+        if: github.event.action == 'published'
+        run: ./.github/set-version
+
       - name: Test
         run: hatch run pytest --color=yes
 
@@ -59,32 +56,15 @@ jobs:
           name: Packages
           path: dist/*
 
-  # Upload to Test PyPI on every commit on main.
-  release-test-pypi:
-    name: Publish in-dev package to test.pypi.org
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+  release:
+    name: Publish
     runs-on: ubuntu-latest
-    needs: build
-
-    steps:
-      - name: Download package
-        uses: actions/download-artifact@v3
-        with:
-          name: Packages
-          path: dist
-
-      - name: Upload to Test PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
-          repository-url: https://test.pypi.org/legacy/
-
-  # Upload to real PyPI on GitHub Releases.
-  release-pypi:
-    name: Publish released package to pypi.org
     if: github.event.action == 'published'
-    runs-on: ubuntu-latest
     needs: build
+    environment: pypi-release
+
+    permissions:
+      id-token: write
 
     steps:
       - name: Download package
@@ -93,7 +73,5 @@ jobs:
           name: Packages
           path: dist
 
-      - name: Upload package to PyPI
+      - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}

DEVELOPERS.md

@@ -0,0 +1,6 @@
+# For Developers
+
+## How to release?
+
+* Create a new GitHub Release
+* Publish the release

structlog_gcp/__about__.py

@@ -1 +1 @@
-__version__ = "0.2.1"
+__version__ = "0.0.1.dev"  # Will be overwritten during deployment