Repository: pyodide/pyodide-build (language: python)

Issue:
0.29 release
It would be great if we could tag a release soon, with these PRs:

- #27
- #30
- #28 
- #29 


Would you like to include #21, too, or leave that for another release, @ryanking13?

and we could resolve this issue, too, perhaps? It looks quite easy to do and would help the conda-forge folks serve better metadata.

- #11 

I would probably leave out #14 for later, because it is slightly low priority for me to do (useful for some packages, but not a lot of packages)

I shall be available to help do the release – if it is needed of me to do so.


Discussion / hints:
Sure, let's release 0.29 after resolving your open PRs. #21 would take some time, so it doesn't need to be included.
> I shall be available to help do the release – if it is needed of me to do so.

Releasing pyodide-build is quite easy (it is a benefit of unvendoring things :) ); you just need to update the changelog, and create a tag. So feel free to make a release when it is ready.
Awesome! I'll do it this week when I am ready. Thanks for the help in getting all those PRs merged!
Also, would it be okay to switch to using GitHub Releases from tags, instead of just tags? This improves our security practices, because one needs permissions in the repository to create a GitHub Release instead of just being able to push a tag (side note: we should add some [tag protection rules](https://github.blog/changelog/2022-03-09-tag-protection-rules/), if we haven't already). So, it would have the benefit of not triggering a PyPI release when a tag is pushed, so that we can use our trusted publishing better and make use of the GHA Attestations feature.
> Also, would it be okay to switch to using GitHub Releases from tags, instead of just tags?

Sure, fine with me.

Fix patch:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4acec7b..2b88aeb 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,4 +1,4 @@
-name: main
+name: CI
 
 on:
   push:
@@ -9,33 +9,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-
-      - name: Setup Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
-        with:
-          node-version: "20"
-
-      - name: Build
-        run: |
-          python -m pip install build
-          python -m build .
-
-      - name: Store the distribution packages
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
-        with:
-          name: python-package-distributions
-          path: dist/
-          if-no-files-found: error
-
   test:
     runs-on: ubuntu-latest
     steps:
@@ -78,7 +51,18 @@ jobs:
 
       - id: check-integration-test-trigger
         name: Check integration test trigger
-        run: bash tools/check_integration_test_trigger.sh
+        shell: bash
+        run: |
+          set -e -x
+
+          COMMIT_MSG=$(git log --no-merges -1 --oneline)
+
+          # The integration tests will be triggered on push or on pull_request when the commit
+          # message contains "[integration]"
+          if [[ "$GITHUB_EVENT_NAME" == push ||
+                "$COMMIT_MSG" =~ \[integration\] ]]; then
+              echo "trigger=true" >> "$GITHUB_OUTPUT"
+          fi
 
   integration-test:
     runs-on: ubuntu-latest
@@ -119,24 +103,3 @@ jobs:
         run: |
           cd integration_tests
           make test-recipe
-
-  publish:
-    name: Publish to PyPI
-    needs:
-      - build
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
-    environment:
-      name: pypi
-      url: https://pypi.org/p/pyodide-build
-    permissions:
-      id-token: write # IMPORTANT: mandatory for trusted publishing
-    steps:
-      - name: Download all the dists
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          path: dist/
-          merge-multiple: true
-
-      - name: Publish distribution 📦 to PyPI
-        uses: pypa/gh-action-pypi-publish@0ab0b79471669eb3a4d647e625009c62f9f3b241 # v1.10.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..79d32f5
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,58 @@
+name: CD
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+  schedule:
+    - cron: "0 3 * * 1"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+      - name: Setup Python
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+        with:
+          python-version: "3.12"
+
+      - name: Build
+        run: |
+          python -m pip install build
+          python -m build .
+
+      - name: Store the distribution packages
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        with:
+          name: python-package-distributions
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    name: Publish to PyPI
+    needs: [build]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'release' && github.event.action == 'published'
+    environment:
+      name: pypi
+      url: https://pypi.org/p/pyodide-build
+    permissions:
+      id-token: write # IMPORTANT: mandatory for trusted publishing
+      attestations: write
+      contents: read
+    steps:
+      - name: Download all the dists
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          path: dist/
+          merge-multiple: true
+
+      - name: Generate artifact attestations
+        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
+        with:
+          subject-path: "dist/*"
+
+      - name: Publish distribution 📦 to PyPI
+        uses: pypa/gh-action-pypi-publish@0ab0b79471669eb3a4d647e625009c62f9f3b241 # v1.10.1


Test patch:
diff --git a/tools/check_integration_test_trigger.sh b/tools/check_integration_test_trigger.sh
deleted file mode 100755
index 19b88b4..0000000
--- a/tools/check_integration_test_trigger.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/bash
-
-set -e
-set -x
-
-COMMIT_MSG=$(git log --no-merges -1 --oneline)
-
-# The integration tests will be triggered on push or on pull_request when the commit
-# message contains "[integration]"
-if [[ "$GITHUB_EVENT_NAME" == push ||
-      "$COMMIT_MSG" =~ \[integration\] ]]; then
-    echo "trigger=true" >> "$GITHUB_OUTPUT"
-fi