This document describes how to cut a release. The short version: you bump the version, tag the commit, and push the tag. CI does the building and publishing. Everything below is the detail behind that sentence.
These steps happen once, before the first release. They let GitHub Actions publish to PyPI without anyone handling an API token.
-
Create the project on PyPI at https://pypi.org/manage/projects/ using the name
gpu_stack. -
Configure a Trusted Publisher on PyPI (no API token required):
- Go to your PyPI project > Publishing > Add a new publisher
- Provider: GitHub Actions
- Repository owner: your GitHub org or username
- Repository name:
gpu_stack- - Workflow name:
release.yml - Environment name:
pypi
-
Create a GitHub environment named
pypiin the repository settings (Settings > Environments). Restrict deployments to tag patterns or add a required reviewer to prevent accidental publishes.
-
Update the version in
pyproject.toml(version = "X.Y.Z"). -
Update
CHANGELOG.mdwith the new version heading and release notes. -
Commit both files:
git add pyproject.toml CHANGELOG.md git commit -m "Release vX.Y.Z" -
Tag the commit and push both the commit and the tag:
git tag vX.Y.Z git push origin main git push origin vX.Y.Z
When a v* tag is pushed, .github/workflows/release.yml runs two jobs in
sequence:
-
build: installs
buildandtwine, runspython -m buildto produce an sdist and a wheel, runstwine check dist/*to validate metadata, and uploads the artifacts to the workflow run. -
publish: downloads the artifacts and publishes them to PyPI using
pypa/gh-action-pypi-publishvia OIDC trusted publishing. This job requires thepypiGitHub environment to exist and will only run when the ref is a version tag. The one-time PyPI and GitHub setup described above must be completed before this job can succeed.
You do not need this for a normal release, but it is the fastest way to check that the package builds before tagging:
pip install -e ".[release]"
python -m build
twine check dist/*