Add GitHub Actions workflow for publishing to PyPI

[leouieda]

Use a separate workflow that doesn't run on pull requests. Builds the
archives/wheels and pushes to test PyPI on pushes to the master branch
and to PyPI proper on releases.

Reminders:

• Run make format and make check to make sure the code follows the style guide.
• Add tests for new features or tests that would have caught the bug that you're fixing.
• Add new public functions/methods/classes to doc/api/index.rst and the base __init__.py file for the package.
• Write detailed docstrings for all functions/classes/methods. It often helps to design better code if you write the docstrings first.
• If adding new functionality, add an example to the docstring, gallery, and/or tutorials.
• Add your full name, affiliation, and ORCID (optional) to the AUTHORS.md file (if you haven't already) in case you'd like to be listed as an author on the Zenodo archive of the next release.

[leouieda]

@hugovk @dopplershift I implemented a workflow similar to what Hugo suggested in #195.

I set it up as a separate workflow since it's only really critical when we make a release and it would be hard to have a broken release if the master branch is passing all tests (unless the PyPI upload itself is broken, which would be caught by the test pypi upload). Does this seem sensible? I struggled with this decision quite a bit.

The test releases seem to be working: https://test.pypi.org/project/pooch/#history

I enabled the deploy on this branch to test PyPI for now but will remove it before merging.

[dopplershift]

I think if: success() is the default.

[leouieda]

👍🏽 I thought so but just wanted to be safe

[dopplershift]

Well that's paranoid...and not a bad idea.

[leouieda]

😆 yeah that blog post linked in that comment made my skin crawl

[hugovk]

Which blog post?

[leouieda]

This one: https://julienrenaux.fr/2019/12/20/github-actions-security-risk/

[leouieda]

TODO:

• Remove this branch from the deploy script
• Remove PyPI deploy from TravisCI config

[dopplershift]

Technically, you could rely on the fact that secrets.PYPI_TOKEN is only available on the original repo. If someone else put their own token as a secret on their fork, it would only work if it had permission on pypi.org. Just thinking out loud...

[leouieda]

Yeah, but that would mean that the workflow runs and raises an error for most contributors when they update their forks. I get really bothered by those red crosses...

[dopplershift]

In general this makes sense, but it's also the kind of things I never get right the first time. So hopefully the pushes to test.pypi.org work...

[leouieda]

🤞🏽 but it seems to work for test.pypi.org so far. I guess we might have to merge this and see. But if it works on test.pypi it should work on pypi, right? Why would something like this ever break unexpectedly?

[hugovk]

This is part of pypa/gh-action-pypi-publish by default:

https://github.com/pypa/gh-action-pypi-publish#disabling-metadata-verification

[leouieda]

Ah right. But then again, they also that we should be running this. Might just leave it since it takes a few seconds only.

[hugovk]

I set it up as a separate workflow since it's only really critical when we make a release and it would be hard to have a broken release if the master branch is passing all tests (unless the PyPI upload itself is broken, which would be caught by the test pypi upload). Does this seem sensible? I struggled with this decision quite a bit.

Yep, sounds sensible.

I have separate workflows for lint, test, and deploy. It also means if, say, there's some temporary network error which stops deploy, you can restart just the deploy workflow.

[leouieda]

@hugovk thanks for the comments!

I have separate workflows for lint, test, and deploy.

Thanks for sharing that link to your tinytext project! It really cleared up some things for me.

It also means if, say, there's some temporary network error which stops deploy, you can restart just the deploy workflow.

That's what I figured. Plus, I'm super paranoid with the CI on master so the release should be safe (famous last words).

[leouieda]

Alright fingers crossed that this actually works 🤞🏽

[leouieda]

It works! https://test.pypi.org/project/pooch/#history