Publish blurb to PyPI using Trusted Publishers

[hugovk]

The short story

It would be nice to automate releases.

Long version

Similar to cherry_picker (python/cherry-picker#94), let's set up automated deploys to PyPI.

We'll need to pick a tag name format, so far we only have cherry-picker-vX.Y.Z in this repo: https://github.com/python/core-workflow/tags. Shall we use blurb-vX.Y.Z here?

TODO

• Move blurb to own repo Should blurb and cherry_picker move to their own repos? core-workflow#329
• Decide on tag name
• Reserve blurb on https://test.pypi.org/project/blurb/
• Add other people to https://test.pypi.org/project/blurb/ to improve bus factor - who else shall I add there?
• Create release workflow: python/blurb#14
• Set up Trusted Publisher on https://test.pypi.org/project/blurb/
• Set up Trusted Publisher on https://pypi.org/project/blurb/

Thanks for blurb!

[ezio-melotti]

I would add "move blurb to its own repo" at the top of the checklist, otherwise sounds good to me.

[hugovk]

Added!

Once in its own repo, we don't need to worry about tag collisions and can use a more standard X.Y.Z or vX.Y.Z.

[hugovk]

blurb is now in its own repo 🚀

Once in its own repo, we don't need to worry about tag collisions and can use a more standard X.Y.Z or vX.Y.Z.

No strong preference from me, some prefer vX.Y.Z because it allows matching with a v* wildcard. We also X.Y.Z for branches and vX.Y.Z for tags in https://github.com/python/cpython, so "copy CPython" is good enough for me: let's use vX.Y.Z.

---

I've set up the Trusted Publisher for TestPyPI at https://test.pypi.org/manage/project/blurb/settings/publishing/

Here's a PR to add the release workflow: python/blurb#14. We can merge this before setting it up on production PyPI, it'll verify the TestPyPI setup.

Then we need to set up production PyPI before doing a proper release.

[webknjaz]

@hugovk I suggest using a GitHub Environment called testpypi for the TestPyPI uploads and pypi for the regular PyPI. This is what I use in the guides and IRL.

[hugovk]

I merged #14 and it successfully deployed in https://github.com/python/blurb/actions/runs/8661563398/job/23751747417 to https://test.pypi.org/project/blurb/0.1.dev64/ ✅

[hugovk]

[ ] Add other people to test.pypi.org/project/blurb to improve bus factor - who else shall I add there?

@ambv Can I add you? Do you have a Test PyPI account?

---

[ ] Set up Trusted Publisher on pypi.org/project/blurb

I see Brett and Larry listed at https://pypi.org/project/blurb/

@brettcannon or @larryhastings:

Please could you either set up Trusted Publishers for blurb here using the same settings as #4 (comment)

OR add @ambv and I'll ask him to do it?

Thanks!

[ambv]

I'm happy to help! I'm ambvtest on test.pypi.org.

[hugovk]

Thanks, invited!

[ambv]

Accepted!

[webknjaz]

Please could you either set up Trusted Publishers for blurb here using the same settings as #4 (comment)

Correction: the settings should be almost the same. The Environment name field must be pypi per 4bcc5b1. In case of a mismatch, PyPI will reject uploads.

[hugovk]

@brettcannon When you get a moment, please could you either set up Trusted Publishers for blurb here using the same settings as #4 (comment)?

Or add @ambv or me to the PyPI project and we can do it?

Thank you!

[brettcannon]

@hugovk I unfortunately can't as I'm not an admin on the project. @larryhastings will need to add someone to make the changes.