CI integration testing for uv publish

.github/workflows/ci.yml

@@ -889,6 +889,61 @@ jobs:
  run: |
  ./uv pip install anyio --reinstall
 
+ integration-test-publish:
+ timeout-minutes: 10
+ needs: build-binary-linux
+ name: "integration test | uv publish"
+ runs-on: ubuntu-latest
+ # Only the main repository is a trusted publisher
+ # TODO(konsti): CHANGE BEFORE MERGE
+ if: github.repository == 'konstin/uv'
+ environment: uv-test-publish
+ env:
+ # No dbus in GitHub Actions
+ PYTHON_KEYRING_BACKEND: keyrings.alt.file.PlaintextKeyring
+ steps:
+ - uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+
+ # Only publish a new release if the
+ - uses: tj-actions/changed-files@v45
+ id: changed
+ with:
+ files_yaml: |
+ code:
+ - "crates/uv-publish/**/*"
+ - "scripts/publish/**/*"
+
+ - uses: actions/setup-python@v5
+ with:
+ python-version: "3.12"
+
+ - name: "Download binary"
+ uses: actions/download-artifact@v4
+ with:
+ name: uv-linux-${{ github.sha }}
+
+ - name: "Prepare binary"
+ run: chmod +x ./uv
+
+ - name: "Add password to keyring"
+ run: |
+ # `keyrings.alt` contains the plaintext keyring
+ ./uv tool install --with keyrings.alt "keyring<25.4.0" # TODO(konsti): Remove upper bound once fix is released
+ echo $UV_TEST_PUBLISH_KEYRING | keyring set https://test.pypi.org/legacy/?astral-test-keyring __token__
+ env:
+ UV_TEST_PUBLISH_KEYRING: ${{ secrets.UV_TEST_PUBLISH_KEYRING }}
+
+ - name: "Publish test packages"
+ if: ${{ steps.changed.outputs.code_any_changed }}
+ # `-p 3.12` prefers the python we just installed over the on locked `.python_version`.
+ run: ./uv run -p 3.12 scripts/publish/test_publish.py --uv ./uv all
+ env:
+ RUST_LOG: uv=debug,uv_publish=trace
+ UV_TEST_PUBLISH_TOKEN: ${{ secrets.UV_TEST_PUBLISH_TOKEN }}
+ UV_TEST_PUBLISH_PASSWORD: ${{ secrets.UV_TEST_PUBLISH_PASSWORD }}
+
  cache-test-ubuntu:
  timeout-minutes: 10
  needs: build-binary-linux

scripts/publish/.gitignore

@@ -0,0 +1 @@
+astral-test-*

scripts/publish/test_publish.py

@@ -0,0 +1,159 @@
+# /// script
+# requires-python = ">=3.12"
+# dependencies = [
+# "httpx>=0.27,<0.28",
+# "packaging>=24.1,<25",
+# ]
+# ///
+
+"""
+Test `uv publish` by uploading a new version of astral-test-<test case> to testpypi,
+authenticating by one of various options.
+
+# Setup
+
+**astral-test-token**
+Set the `UV_TEST_PUBLISH_TOKEN` environment variables.
+
+**astral-test-password**
+Set the `UV_TEST_PUBLISH_PASSWORD` environment variable.
+This project also uses token authentication since it's the only thing that PyPI
+supports, but they both CLI options.
+TODO(konsti): Add an index for testing that supports username/password.
+
+**astral-test-keyring**
+```console
+uv pip install keyring
+keyring set https://test.pypi.org/legacy/?astral-test-keyring __token__
+```
+The query parameter a horrible hack stolen from
+https://github.com/pypa/twine/issues/565#issue-555219267
+to prevent the other projects from implicitly using the same credentials.
+"""
+
+import os
+import re
+from argparse import ArgumentParser
+from pathlib import Path
+from shutil import rmtree
+from subprocess import check_call
+
+import httpx
+from packaging.utils import parse_sdist_filename, parse_wheel_filename
+
+cwd = Path(__file__).parent
+
+
+def get_new_version(project_name: str) -> str:
+ """Return the next free path version on pypi"""
+ index_page = f"https://test.pypi.org/simple/{project_name}/?format=application/vnd.pypi.simple.v1+json"
+ data = httpx.get(index_page).json()
+ versions = set()
+ for file in data["files"]:
+ if file["filename"].endswith(".whl"):
+ [_name, version, _build, _tags] = parse_wheel_filename(file["filename"])
+ else:
+ [_name, version] = parse_sdist_filename(file["filename"])
+ versions.add(version)
+ max_version = max(versions)
+
+ # Bump the path version to obtain an empty version
+ release = list(max_version.release)
+ release[-1] += 1
+ return ".".join(str(i) for i in release)
+
+
+def create_project(project_name: str, uv: Path):
+ if cwd.joinpath(project_name).exists():
+ rmtree(cwd.joinpath(project_name))
+ check_call([uv, "init", "--lib", project_name], cwd=cwd)
+ pyproject_toml = cwd.joinpath(project_name).joinpath("pyproject.toml")
+
+ # Set to an unclaimed version
+ toml = pyproject_toml.read_text()
+ new_version = get_new_version(project_name)
+ toml = re.sub('version = ".*"', f'version = "{new_version}"', toml)
+ pyproject_toml.write_text(toml)
+
+
+def publish_project(project_name: str, uv: Path):
+ # Create the project
+ create_project(project_name, uv)
+
+ # Build the project
+ check_call([uv, "build"], cwd=cwd.joinpath(project_name))
+
+ # Upload the project
+ if project_name == "astral-test-token":
+ env = os.environ.copy()
+ env["UV_PUBLISH_TOKEN"] = os.environ["UV_TEST_PUBLISH_TOKEN"]
+ check_call(
+ [
+ uv,
+ "publish",
+ "--publish-url",
+ "https://test.pypi.org/legacy/",
+ ],
+ cwd=cwd.joinpath(project_name),
+ env=env,
+ )
+ elif project_name == "astral-test-password":
+ env = os.environ.copy()
+ env["UV_PUBLISH_PASSWORD"] = os.environ["UV_TEST_PUBLISH_PASSWORD"]
+ check_call(
+ [
+ uv,
+ "publish",
+ "--publish-url",
+ "https://test.pypi.org/legacy/",
+ "--username",
+ "__token__",
+ ],
+ cwd=cwd.joinpath(project_name),
+ env=env,
+ )
+ elif project_name == "astral-test-keyring":
+ check_call(
+ [
+ uv,
+ "publish",
+ "--publish-url",
+ "https://test.pypi.org/legacy/?astral-test-keyring",
+ "--username",
+ "__token__",
+ "--keyring-provider",
+ "subprocess",
+ ],
+ cwd=cwd.joinpath(project_name),
+ )
+ else:
+ raise ValueError(f"Unknown project name: {project_name}")
+
+
+def main():
+ parser = ArgumentParser()
+ projects = ["astral-test-token", "astral-test-password", "astral-test-keyring"]
+ parser.add_argument("projects", choices=projects + ["all"], nargs="+")
+ parser.add_argument("--uv")
+ args = parser.parse_args()
+
+ if args.uv:
+ # We change the working directory for the subprocess calls, so we have to
+ # absolutize the path.
+ uv = Path.cwd().joinpath(args.uv)
+ else:
+ check_call(["cargo", "build"])
+ executable_suffix = ".exe" if os.name == "nt" else ""
+ uv = cwd.parent.parent.joinpath(f"target/debug/uv{executable_suffix}")
+
+ if args.projects == ["all"]:
+ projects = projects
+ else:
+ projects = args.projects
+
+ for project_name in projects:
+ publish_project(project_name, uv)
+
+
+if __name__ == "__main__":
+ main()