ci: Split build and deploy steps

.github/workflows/ci_workflow.yml

@@ -15,9 +15,9 @@ jobs:
         python-version: ["3.10"]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install Poetry
@@ -43,13 +43,14 @@ jobs:
       SF_WAREHOUSE: ${{secrets.SF_WAREHOUSE}}
       SF_ROLE: ${{secrets.SF_ROLE}}
     strategy:
+      max-parallel: 2
       matrix:
         python-version: ["3.8", "3.9", "3.10", "3.11"]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install Poetry

.github/workflows/project_add.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.actor != 'dependabot[bot]' }}
     steps:
-      - uses: actions/add-to-project@v0.5.0
+      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
         with:
           project-url: https://github.com/orgs/MeltanoLabs/projects/3
           github-token: ${{ secrets.MELTYBOT_PROJECT_ADD_PAT }}

.github/workflows/release_workflow.yml

@@ -1,43 +1,41 @@
 name: Upload Python Package
 
 on:
-  release:
-    types: [published]  # Trigger only when a release is published, not when a release is drafted
+  push:
 
 permissions:
   contents: write  # Needed to upload artifacts to the release
   id-token: write  # Needed for OIDC PyPI publishing
 
 jobs:
-  build_deploy:
-
+  build:
+    name: Build and inspect package
     runs-on: ubuntu-latest
-
+    outputs:
+      version: ${{ steps.baipp.outputs.package_version }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0
-    - name: Set up Python
-      uses: actions/setup-python@v3
+    - uses: hynek/build-and-inspect-python-package@b5076c307dc91924a82ad150cdd1533b444d3310 # v2.12.0
+      id: baipp
+
+  deploy:
+    if: startsWith(github.ref, 'refs/tags/')
+    name: Deploy package to PyPI
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
-        python-version: '3.10'
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install poetry
-    - name: Build package
-      run: |
-        poetry self add "poetry-dynamic-versioning[plugin]"
-        poetry config repositories.testpypi https://test.pypi.org/legacy/
-        poetry dynamic-versioning --no-cache
-        poetry build
+        name: Packages
+        path: dist
     - name: Upload wheel to release
-      uses: svenstaro/upload-release-action@v2
+      uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # 2.9.0
       with:
         repo_token: ${{ secrets.GITHUB_TOKEN }}
         file: dist/*.whl
         tag: ${{ github.ref }}
         overwrite: true
         file_glob: true
     - name: Publish
-      uses: pypa/gh-action-pypi-publish@v1.8.5
+      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4

pyproject.toml

@@ -63,7 +63,7 @@ convention = "google"
 max-complexity = 10
 
 [build-system]
-requires = ["poetry-core>=1.0.8", "poetry-dynamic-versioning"]
+requires = ["poetry-core==2.0.1", "poetry-dynamic-versioning==1.7.1"]
 build-backend = "poetry_dynamic_versioning.backend"
 
 [tool.poetry.scripts]