.gitlab-ci.yml

---
image: python:3.11

variables:
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"

cache:
  paths:
    - .cache/pip
    - venv/

before_script:
  - python -V # Print out python version for debugging
  - pip install twine tox ruff pytest build

linting:
  stage: test
  script:
    - tox -e ruff,yamllint

build-job:
  stage: build
  image: python:3-bookworm
  script:
    - python -m pip install -U build
    - python -m build
  artifacts:
    paths:
      - "dist/"

generate-pypi-attestations:
  stage: build
  image: python:3-bookworm
  needs:
    - job: build-job
      artifacts: true
  id_tokens:
    SIGSTORE_ID_TOKEN:
      aud: sigstore
  script:
    - python -m pip install -U pypi-attestations
    - python -m pypi_attestations sign dist/*
  artifacts:
    paths:
      - "dist/"

publish-job:
  stage: deploy
  image: python:3-bookworm
  dependencies:
    - build-job
    - generate-pypi-attestations
  id_tokens:
    PYPI_ID_TOKEN:
      aud: pypi
  script:
    # Install dependencies
    - apt update && apt install -y jq
    - python -m pip install -U twine id

    # Retrieve the OIDC token from GitLab CI/CD, and exchange it for a PyPI API token
    - oidc_token=$(python -m id pypi)
    - resp=$(curl -X POST https://pypi.org/_/oidc/mint-token -d "{\"token\":\"${oidc_token}\"}")
    - api_token=$(jq --raw-output '.token' <<< "${resp}")

    # Upload to PyPI authenticating via the newly-minted token, including the generated attestations
    # Add "--repository testpypi" if uploading to TestPyPI
    - twine upload --verbose --attestations -u __token__ -p "${api_token}" dist/*
  only:
    - tags

python311:
  stage: test
  image: python:3.11
  script: tox -e py311

python312:
  stage: test
  image: python:3.12
  script: tox -e py312

python313:
  stage: test
  image: python:3.13
  script: tox -e py313