Update ci

.github/workflows/publish.yml

@@ -1,189 +1,258 @@
-name: Publish to PyPI
+# This workflow will upload a Python Package to PyPI when a release is created
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: Upload PyPI package
 
 on:
   release:
-    types: [published]
+    types: [published, edited]
   workflow_dispatch:
     inputs:
       test_pypi:
-        description: 'Publish to Test PyPI instead of PyPI'
+        description: "Publish to Test PyPI instead of PyPI"
         required: false
-        default: 'false'
+        default: false
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
-  test:
-    name: Run tests before publish
+  # Step 1: Code formatting and pre-commit validation (fast failure)
+  code-format:
+    name: Code formatting and pre-commit validation
     runs-on: ubuntu-latest
-    
-    steps:
-    - uses: actions/checkout@v4
-    
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.12'
-        
-    # - name: Install dependencies
-    #   run: |
-    #     python -m pip install --upgrade pip
-    #     pip install -e .
-        
-    # - name: Run comprehensive tests
-    #   run: |
-    #     python -m pytest --cov=msgcenterpy --cov-fail-under=80
-        
-    # - name: Run linting
-    #   run: |
-    #     black --check msgcenterpy tests
-    #     isort --check-only msgcenterpy tests
-    #     mypy msgcenterpy
 
-  build:
-    name: Build package
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.10" # Use minimum version for consistency
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[dev]
+
+      - name: Run pre-commit hooks
+        uses: pre-commit/action@v3.0.1
+        with:
+          extra_args: --all-files
+
+  # Step 2: Basic build and test with minimum Python version (3.10)
+  basic-build:
+    name: Basic build (Python 3.10, Ubuntu)
     runs-on: ubuntu-latest
-    needs: test
-    
-    steps:
-    - uses: actions/checkout@v4
-    
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.12'
-        
-    # - name: Install build dependencies
-    #   run: |
-    #     python -m pip install --upgrade pip
-    #     pip install build twine check-manifest
-        
-    # - name: Verify version consistency
-    #   run: |
-    #     # 检查版本号一致性
-    #     VERSION=$(python -c "import elevator_saga; print(elevator_saga.__version__)" 2>/dev/null || echo "unknown")
-    #     TAG_VERSION="${GITHUB_REF#refs/tags/v}"
-    #     if [ "$GITHUB_EVENT_NAME" = "release" ]; then
-    #       if [ "$VERSION" != "$TAG_VERSION" ]; then
-    #         echo "Version mismatch: package=$VERSION, tag=$TAG_VERSION"
-    #         exit 1
-    #       fi
-    #     fi
-        
-    # - name: Check manifest
-    #   run: check-manifest
-      
-    - name: Install build dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install build twine check-manifest
-        
-    - name: Build package
-      run: |
-        python -m build
-        
-    # - name: Check package
-    #   run: |
-    #     twine check dist/*
-        
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: dist-${{ github.run_number }}
-        path: dist/
-        retention-days: 30
+    needs: [code-format] # Only run after code formatting passes
 
-  publish-test:
-    name: Publish to Test PyPI
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.10"
+
+      - name: Cache pip dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: ubuntu-pip-3.10-${{ hashFiles('**/pyproject.toml') }}
+          restore-keys: |
+            ubuntu-pip-3.10-
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install pytest
+          pip install -e .[dev]
+
+      - name: Test with pytest
+        run: |
+          pytest -v
+
+  # Step 3: Security scan
+  security:
+    name: Security scan
     runs-on: ubuntu-latest
-    needs: build
-    if: github.event.inputs.test_pypi == 'true' || (github.event_name == 'release' && github.event.release.prerelease)
-    environment:
-      name: test-pypi
-      url: https://test.pypi.org/p/elevator-saga
-      
-    steps:
-    - name: Download build artifacts
-      uses: actions/download-artifact@v3
-      with:
-        name: dist-${{ github.run_number }}
-        path: dist/
-        
-    - name: Publish to Test PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        repository-url: https://test.pypi.org/legacy/
-        password: ${{ secrets.TEST_PYPI_API_TOKEN }}
-        verbose: true
+    needs: [basic-build] # Run in parallel with other tests after basic build
 
-  publish-pypi:
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Run Safety CLI to check for vulnerabilities
+        uses: pyupio/safety-action@v1
+        with:
+          api-key: ${{ secrets.SAFETY_CHECK }}
+          output-format: json
+          args: --detailed-output --output-format json
+        continue-on-error: true
+
+      - name: Upload security reports
+        uses: actions/upload-artifact@v4
+        with:
+          name: security-reports
+          path: |
+            safety-report.json
+        if: always()
+
+  release-build:
+    name: Build release distributions
+    runs-on: ubuntu-latest
+    needs: [basic-build]
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.10" # Use minimum version for consistency
+
+      - name: Install build dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build twine
+
+      - name: Verify version consistency
+        if: github.event_name == 'release' && (github.event.action == 'published' || (github.event.action == 'edited' && !github.event.release.prerelease))
+        run: |
+          # Install package first
+          pip install -e .
+
+          # Get package version (fail fast if not available)
+          VERSION=$(python -c "import elevator_saga; print(elevator_saga.__version__)")
+
+          # Handle both v0.0.3 and 0.0.3 tag formats
+          RAW_TAG="${GITHUB_REF#refs/tags/}"
+          if [[ "$RAW_TAG" == v* ]]; then
+            TAG_VERSION="${RAW_TAG#v}"
+          else
+            TAG_VERSION="$RAW_TAG"
+          fi
+
+          echo "Package version: $VERSION"
+          echo "Tag version: $TAG_VERSION"
+
+          if [ "$VERSION" != "$TAG_VERSION" ]; then
+            echo "❌ Version mismatch: package=$VERSION, tag=$TAG_VERSION"
+            echo "Please ensure the package version matches the git tag"
+            exit 1
+          fi
+
+          echo "✅ Version verification passed: $VERSION"
+
+      - name: Build release distributions
+        run: |
+          python -m build
+
+      - name: Check package
+        run: |
+          twine check dist/*
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-dists
+          path: dist/
+
+  pypi-publish:
     name: Publish to PyPI
     runs-on: ubuntu-latest
-    needs: build
-    if: github.event_name == 'release' && !github.event.release.prerelease && github.event.inputs.test_pypi != 'true'
-    environment:
-      name: pypi
-      url: https://pypi.org/p/elevator-saga
-      
+    needs:
+      - release-build
+    if: github.event_name == 'release' && !github.event.release.prerelease && github.event.inputs.test_pypi != 'true' && (github.event.action == 'published' || github.event.action == 'edited')
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
+
+    # Note: For enhanced security, consider configuring deployment environments
+    # in your GitHub repository settings with protection rules
+
     steps:
-    - name: Download build artifacts
-      uses: actions/download-artifact@v3
-      with:
-        name: dist-${{ github.run_number }}
-        path: dist/
-        
-    - name: Publish to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        password: ${{ secrets.PYPI_API_TOKEN }}
-        verbose: true
+      - name: Retrieve release distributions
+        uses: actions/download-artifact@v5
+        with:
+          name: release-dists
+          path: dist/
+
+      - name: Publish release distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  test-pypi-publish:
+    name: Publish to Test PyPI
+    runs-on: ubuntu-latest
+    needs:
+      - release-build
+    if: github.event.inputs.test_pypi == 'true' || (github.event_name == 'release' && github.event.release.prerelease && (github.event.action == 'published' || github.event.action == 'edited'))
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
+
+    # Note: For enhanced security, consider configuring deployment environments
+    # in your GitHub repository settings with protection rules
+
+    steps:
+      - name: Retrieve release distributions
+        uses: actions/download-artifact@v5
+        with:
+          name: release-dists
+          path: dist/
+
+      - name: Publish release distributions to Test PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
 
   create-github-release-assets:
     name: Add assets to GitHub release
     runs-on: ubuntu-latest
-    needs: build
-    if: github.event_name == 'release'
-    
+    needs: release-build
+    if: github.event_name == 'release' && (github.event.action == 'published' || github.event.action == 'edited')
+    permissions:
+      contents: write # Need write access to upload release assets
+
     steps:
-    - name: Download build artifacts
-      uses: actions/download-artifact@v3
-      with:
-        name: dist-${{ github.run_number }}
-        path: dist/
-        
-    - name: Upload release assets
-      uses: softprops/action-gh-release@v1
-      with:
-        files: dist/*
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Retrieve release distributions
+        uses: actions/download-artifact@v5
+        with:
+          name: release-dists
+          path: dist/
+
+      - name: Upload release assets
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   post-publish:
     name: Post-publish tasks
     runs-on: ubuntu-latest
-    needs: [publish-pypi, publish-test]
-    if: always() && (needs.publish-pypi.result == 'success' || needs.publish-test.result == 'success')
-    
-    steps:
-    - uses: actions/checkout@v4
-    
-    - name: Create deployment summary
-      run: |
-        echo "## 🚀 Deployment Summary" >> $GITHUB_STEP_SUMMARY
-        echo "| Item | Status |" >> $GITHUB_STEP_SUMMARY
-        echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
-        
-        if [ "${{ needs.publish-pypi.result }}" = "success" ]; then
-          echo "| PyPI | ✅ Published |" >> $GITHUB_STEP_SUMMARY
-        elif [ "${{ needs.publish-test.result }}" = "success" ]; then
-          echo "| Test PyPI | ✅ Published |" >> $GITHUB_STEP_SUMMARY
-        fi
-        
-        echo "| GitHub Release | ✅ Assets uploaded |" >> $GITHUB_STEP_SUMMARY
-        echo "| Version | ${{ github.event.release.tag_name || 'test' }} |" >> $GITHUB_STEP_SUMMARY
-        
-    # 为将来的通知预留
-    - name: Notify team
-      run: |
-        echo "Package published successfully!"
-        # 可以添加 Slack、Discord 等通知
+    needs: [pypi-publish, test-pypi-publish]
+    if: always() && (needs.pypi-publish.result == 'success' || needs.test-pypi-publish.result == 'success')
 
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Create deployment summary
+        run: |
+          echo "## Deployment Summary" >> $GITHUB_STEP_SUMMARY
+          echo "| Item | Status |" >> $GITHUB_STEP_SUMMARY
+          echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
+
+          if [ "${{ needs.pypi-publish.result }}" = "success" ]; then
+            echo "| PyPI | Published |" >> $GITHUB_STEP_SUMMARY
+          elif [ "${{ needs.test-pypi-publish.result }}" = "success" ]; then
+            echo "| Test PyPI | Published |" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "| GitHub Release | Assets uploaded |" >> $GITHUB_STEP_SUMMARY
+          echo "| Version | ${{ github.event.release.tag_name || 'test' }} |" >> $GITHUB_STEP_SUMMARY