cerbia/.github/workflows/code-uv_python-release.yml at main · InditexTech/cerbia · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
# SPDX-License-Identifier: Apache-2.0

name: code-uv-python-release
run-name: Publish Python release from ${{ github.event_name }}

on:
  pull_request:
    types: [closed]
    branches: [main, main-*]
  workflow_dispatch:
    inputs:
      release_type:
        description: Release type to use
        required: true
        default: release-type/minor
        type: choice
        options:
          - release-type/hotfix
          - release-type/multi-hotfix
          - release-type/major
          - release-type/minor
          - release-type/patch

permissions:
  contents: read

concurrency:
  group: code-uv-python-release-${{ github.repository }}-${{ github.event.pull_request.base.ref || github.ref_name }}
  cancel-in-progress: false

jobs:
  release-core:
    name: Prepare and Build Release
    if: >-
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository
    uses: ./.github/workflows/code-uv_python-release-core.yml
    with:
      release_type: ${{ inputs.release_type }}
    secrets:
      APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
      CI_GPG_SECRET_KEY: ${{ secrets.CI_GPG_SECRET_KEY }}
      CI_GPG_SECRET_KEY_PASSWORD: ${{ secrets.CI_GPG_SECRET_KEY_PASSWORD }}

  publish-pypi:
    name: Publish to PyPI
    needs: release-core
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    environment: pypi
    permissions:
      id-token: write
    steps:
      - name: Download release distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: python-distributions-*
          path: dist
          merge-multiple: true

      - name: Validate trusted publishing boundary
        uses: InditexTech/gh-actions/pypi@8a719baa6e8d514ccdfe87cff2baae9007a8b168 # v1.1.5
        with:
          attestations: 'true'
          packages-dir: dist
          skip-existing: 'true'

      - name: Publish distributions with trusted publishing
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          attestations: 'true'
          packages-dir: dist
          skip-existing: 'true'

  github-release:
    name: Create GitHub Release ${{ matrix.release.tag }}
    needs: [release-core, publish-pypi]
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        release: ${{ fromJSON(needs.release-core.outputs.releases) }}
    steps:
      - name: Create GitHub App token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.APP_CLIENT_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          permission-contents: write

      - name: Download release distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-distributions-${{ matrix.release.tag }}
          path: dist

      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          RELEASE_TAG: ${{ matrix.release.tag }}
          RELEASE_VERSION: ${{ matrix.release.version }}
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          assets=(dist/*)
          if [[ ${#assets[@]} -eq 0 ]]; then
            echo "::error title=Missing distributions::The release artifact is empty."
            exit 1
          fi

          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
            gh release upload "$RELEASE_TAG" "${assets[@]}" \
              --repo "$GITHUB_REPOSITORY" \
              --clobber
          else
            gh release create "$RELEASE_TAG" "${assets[@]}" \
              --repo "$GITHUB_REPOSITORY" \
              --title "$RELEASE_VERSION" \
              --generate-notes
          fi