Skip to content

Releasing docgate

Releases use PyPI Trusted Publishing. No PyPI API token belongs in GitHub secrets, the repository, or a developer machine.

One-time PyPI setup

Before the first GitHub release, create a pending Trusted Publisher on PyPI for:

  • PyPI project: docgate
  • Owner: BEASTSHRIRAM
  • Repository: docgate
  • Workflow: publish.yml
  • Environment: pypi

For an already-created project, add the same publisher from the project's Publishing settings. PyPI verifies the GitHub Actions OIDC identity and gives the release workflow a short-lived upload credential.

Release process

  1. Update pyproject.toml and CHANGELOG.md with the release version.
  2. Run the test suite and build locally: python -m pytest -q and python -m build. Also validate the documentation with python -m mkdocs build --strict after installing .[docs].
  3. Commit, tag, and publish a GitHub Release from that tag.
  4. The Publish to PyPI workflow builds source and wheel distributions, generates PyPI attestations, and publishes through Trusted Publishing.

The workflow intentionally runs only for published GitHub Releases. A push or pull request can never upload a package.

Documentation deployment

The separate Deploy documentation workflow builds the MkDocs Material site on pushes to main that affect documentation and deploys it with GitHub Pages. In the repository settings, set Pages to GitHub Actions as the deployment source before the first deployment.