Merge pull request #335 from richardsheridan/reproducible_sha1

reproducibility/provenance for wheels

.github/workflows/ci.yml

@@ -81,7 +81,12 @@ jobs:
           python -m pip install -r requirements/build.txt
       - name: Build sdist wheel
         run: |
+          SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) \
           python -m build --no-isolation  # already isolated & build deps pinned
+      - name: Check distribution
+        run: |
+          python -m pip install twine
+          twine check --strict dist/*
       - name: Set outputs
         id: outputs
         run: |
@@ -93,6 +98,7 @@ jobs:
               requirements/test.txt \
               | base64 -w 0
           )" >> $GITHUB_OUTPUT
+          cd dist && sha256sum * >> $GITHUB_STEP_SUMMARY
       - name: Upload build artifact
         uses: actions/[email protected]
         with:
@@ -331,10 +337,13 @@ jobs:
         run: |
           python -m pip install -U pip
           python -m pip install twine
-      - name: Check distribution
-        run: twine check dist/*
       - name: Publish to Pypi
         run: twine upload dist/*
         env:
           TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+      - name: Upload to GitHub
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload ${{ github.ref_name }} dist/* --repo ${{ github.repository }}

CHEATSHEET.rst

@@ -27,11 +27,9 @@ To run tests
 To run black
 ------------
 
-* Show what changes black wants to make: ``black --diff setup.py
-  trio_parallel``
+* Show what changes black wants to make: ``black --diff trio_parallel``
 
-* Apply all changes directly to the source tree: ``black setup.py
-  trio_parallel``
+* Apply all changes directly to the source tree: ``black trio_parallel``
 
 
 To update pinned requirements
@@ -58,11 +56,6 @@ To make a release
 * Make a release PR on GitHub. Checks must pass.
 
 * Use GitHub release mechanism to tag the release PR merge commit:
-  ``hub release create {version}``
+  ``gh release create {version}``
 
-  * This triggers an action to release on Pypi as well.
-
-* Download the canonical wheel from Pypi:
-  ``pip download --no-deps -d dist trio-parallel=={version}``
-
-* Upload to GitHub: ``hub release edit -a dist/*.whl {version}``
+  * This triggers an action to release on PyPI and GitHub as well.