Merge pull request #840 from pangeo-data/add-trusted-publishing

Add trusted publishing workflows for TestPyPI and PyPI deployments

.github/workflows/publish-production-pypi.yml

@@ -0,0 +1,29 @@
+name: Publish Python 🐍 distributions 📦 to PyPI
+
+on:
+  release:
+    types:
+      - published
+
+jobs:
+  build-n-publish-pypi:
+    name: Build and publish Python 🐍 distributions 📦 to PyPI
+    environment: production
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python3
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.x'
+      - name: Install packaging libraries
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build
+      - name: Build a binary wheel and a source tarball
+        run: |
+          python -m build
+      - name: Publish distribution 📦 to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/publish-staging-testpypi.yml

@@ -0,0 +1,49 @@
+name: Publish Python 🐍 distributions 📦 to TestPyPI
+
+on:
+  push:
+    tags:
+      - 'v*.*' # Push events to matching v*, i.e. v1.0, v20.15.10
+
+jobs:
+  release:
+    name: Create Release from tag
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Create Release
+        uses: softprops/action-gh-release@v1
+        env:
+          # This token is provided by Actions, you do not need to create your own token
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ github.ref }}
+          name: Release ${{ github.ref }}
+          draft: true
+          prerelease: false
+  deploy-testpypi:
+    name: Build and publish Python 🐍 distributions 📦 to TestPyPI
+    needs: release
+    environment: staging
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Python3
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.x'
+    - name: Install packaging libraries
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install build
+    - name: Build a binary wheel and a source tarball
+      run: |
+        python -m build
+    - name: Publish distribution 📦 to Test PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        repository-url: https://test.pypi.org/legacy/
+        skip-existing: true

CHANGELOG.rst

@@ -21,7 +21,7 @@ Internals/Minor Fixes
   (:issue:`826`, :pr:`827`) `Aaron Spring`_
 - Unpin ``xarray`` and ``xclim`` and update package health.
   (:issue:`815`, `feedstock-issue <https://github.com/conda-forge/climpred-feedstock/issues/26>`_, :pr:`831`, :pr:`832`) `Aaron Spring`_, `Trevor James Smith`_, `Mathias Hauser`_
-
+- Add Trusted Publishing and leverage GitHub deployment environments. (:issue:`839`, :pr:`840`) `Trevor James Smith`_
 
 
 climpred v2.3.0 (2022-11-25)
@@ -1228,10 +1228,13 @@ climpred v0.1 (2018-12-20)
 
 Collaboration between Riley Brady and Aaron Spring begins.
 
+.. _`Aaron Spring`: https://github.com/aaronspring
 .. _`Anderson Banihirwe`: https://github.com/andersy005
-.. _`Ray Bell`: https://github.com/raybellwaves
-.. _`Riley X. Brady`: https://github.com/bradyrx
 .. _`Andrew Huang`: https://github.com/ahuang11
-.. _`Kathy Pegion`: https://github.com/kpegion
-.. _`Aaron Spring`: https://github.com/aaronspring
 .. _`Dougie Squire`: https://github.com/dougiesquire
+.. _`Kathy Pegion`: https://github.com/kpegion
+.. _`Mathias Hauser`: https://github.com/mathause
+.. _`Ray Bell`: https://github.com/raybellwaves
+.. _`Riley X. Brady`: https://github.com/bradyrx
+.. _`Trevor Gamblin`: https://github.com/threexc
+.. _`Trevor James Smith`: https://github.com/Zeitsperre

HOWTORELEASE.rst

@@ -13,20 +13,24 @@ changes, a minor version adds functionality, and a patch covers bug fixes.
 
 #. After all tests pass and the PR has been approved, merge the PR into ``main``
 
-#. Tag a release and push to github::
+#. Tag a release and push it to GitHub::
 
     $ git tag -a v1.0.0 -m "Version 1.0.0"
     $ git push upstream main --tags
 
-#. We use Github Actions to automate the new release being published to PyPI.
-   Simply confirm that the new release is reflected at
-   https://pypi.org/project/climpred/. There is typically a delay, but check Github
-   Actions if there's an issue, and otherwise you can manually do it with the
-   following::
+#. We use Github Actions to automate the new release being published to TestPyPI (staging) and PyPI (production).
+   When a tag is pushed to the repository, the following happens:
+    - A new release is drafted on Github
+    - The library is built and a workflow is staged for publishing to TestPyPI
+        - A maintainer must manually approve the workflow to publish to TestPyPI
+    - If everything clears, maintainers can then finalize the release on GitHub, triggering an upload to PyPI
+
+   If you wish to circumvent the GitHub Actions for whatever reason, you can manually do it by running the following::
 
     $ git clean -xfd  # remove any files not checked into git
-    $ python setup.py sdist bdist_wheel --universal  # build package
-    $ twine upload dist/*  # register and push to pypi
+    $ python -m build  # build package
+    $ python -m twine upload --repository-url https://test.pypi.org/legacy dist/*  # register and push to testpypi
+    $ python -m twine upload dist/*  # register and push to pypi
 
 #. Next, update the stable branch with ``main``. This will trigger a stable build
    for ReadTheDocs::
@@ -36,8 +40,8 @@ changes, a minor version adds functionality, and a patch covers bug fixes.
     $ git push -f upstream stable
     $ git checkout main
 
-#. Go to https://readthedocs.org and add the new version to ``"Active Versions"``
-   under the version tab. Force-build ``"stable"`` if it isn't already building.
+#. Go to https://readthedocs.org and add the new version to ``"Active Versions"`` under the version tab.
+   Force-build ``"stable"`` if it isn't already building.
 
 #. Update climpred conda-forge feedstock
 

docs/source/contributors.rst

@@ -9,11 +9,11 @@ Contributors
   prediction community. In our past coding journey, collaborative coding, feedbacking
   issues and pull requests advanced our code and thinking about forecast verification
   more than we could have ever expected.
-  `Aaron <https://github.com/aaronspring/>`_ can provide guidance on
+
+  `Aaron`_ can provide guidance on
   implementing new features into climpred. Feel free to implement
-  your own new feature or take a look at the
-  `good first issue <https://github.com/pangeo-data/climpred/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22>`_
-  tag in the issues. Please reach out to us via `gitter <https://gitter.im/climpred>`_.
+  your own new feature or take a look at the `good first issue`_ tag in the issues.
+  Please reach out to us via `gitter <https://gitter.im/climpred>`_.
 
 Core Developers
 ===============
@@ -22,11 +22,15 @@ Core Developers
 
 Contributors
 ============
-* Andrew Huang (`github <https://github.com/ahuang11/>`__)
-* Kathy Pegion (`github <https://github.com/kpegion/>`__)
 * Anderson Banihirwe (`github <https://github.com/andersy005/>`__)
 * Ray Bell (`github <https://github.com/raybellwaves/>`__)
 * Trevor Gamblin (`github <https://github.com/threexc/>`__)
+* Andrew Huang (`github <https://github.com/ahuang11/>`__)
+* Kathy Pegion (`github <https://github.com/kpegion/>`__)
+* Trevor James Smith (`github <https://github.com/Zeitsperre/>`__)
+
+For a list of all the contributions, see the GitHub `contribution graph`_.
 
-For a list of all the contributions, see the github
-`contribution graph <https://github.com/pangeo-data/climpred/graphs/contributors>`_.
+.. _Aaron: https://github.com/aaronspring/
+.. _contribution graph: https://github.com/pangeo-data/climpred/graphs/contributors
+.. _good first issue: https://github.com/pangeo-data/climpred/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22