oida/.github/workflows/python-release.yml at main · sonicfieldlabs/oida · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
name: Publish Python stack

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      release_ref:
        description: Existing release tag to rebuild and publish
        required: true

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  checks:
    uses: ./.github/workflows/ci.yml
    with:
      release_ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref_name }}

  build:
    needs: checks
    name: Build and verify distributions
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout Oída
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref_name }}
          fetch-depth: 0
          path: oida

      - name: Install uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          version: "0.12.3"
          python-version: "3.12"

      - name: Verify release tag and project version
        working-directory: oida
        env:
          RELEASE_REF: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref_name }}
        run: |
          case "$RELEASE_REF" in
            v*) ;;
            *) echo "release_ref must name a v-prefixed release tag" >&2; exit 1 ;;
          esac
          test "$(git describe --tags --exact-match HEAD)" = "$RELEASE_REF"
          release_version="${RELEASE_REF#v}"
          project_version="$(uv version --short)"
          test "$release_version" = "$project_version"

      - name: Verify reviewed canonical wheels
        working-directory: oida
        run: shasum -a 256 -c vendor/SHA256SUMS

      - name: Assemble reviewed canonical wheels and build Oída
        run: |
          mkdir -p release/akouo release/akousma release/akousmata release/oida
          cp oida/vendor/akouo_contract-*.whl release/akouo/
          cp oida/vendor/akousma-*.whl release/akousma/
          cp oida/vendor/akousmata-*.whl release/akousmata/
          uv build --out-dir "$GITHUB_WORKSPACE/release/oida" oida

      - name: Check distribution metadata
        run: uv run --project oida --extra dev twine check release/*/*

      - name: Verify Oída wheel in an isolated environment
        run: |
          cd "$RUNNER_TEMP"
          uv run --isolated --no-project \
            --find-links "$GITHUB_WORKSPACE/release/akouo" \
            --find-links "$GITHUB_WORKSPACE/release/akousma" \
            --find-links "$GITHUB_WORKSPACE/release/akousmata" \
            --with "$GITHUB_WORKSPACE"/release/oida/sonicfield_oida-*.whl \
            python -c 'import oida, oida.server; print(oida.__version__)'

      - name: Upload verified distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: python-distributions
          path: release
          if-no-files-found: error
          retention-days: 7

  publish:
    name: Publish ${{ matrix.project }} to PyPI
    needs: build
    if: ${{ github.event_name == 'workflow_dispatch' && vars.PYPI_PUBLISH_ENABLED == 'true' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - project: akouo-contract
            directory: akouo
            environment: pypi
          - project: akousma
            directory: akousma
            environment: pypi-akousma
          - project: akousmata
            directory: akousmata
            environment: pypi-akousmata
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment: ${{ matrix.environment }}
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Download verified distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-distributions
          path: release

      - name: Publish ${{ matrix.project }}
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: release/${{ matrix.directory }}
          skip-existing: true
          verify-metadata: true
          attestations: true

  publish-oida:
    name: Publish sonicfield-oida to PyPI
    needs:
      - build
      - publish
    if: ${{ github.event_name == 'workflow_dispatch' && vars.PYPI_PUBLISH_ENABLED == 'true' && vars.PYPI_OIDA_PUBLISH_ENABLED == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment: pypi-sonicfield-oida
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Download verified distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-distributions
          path: release

      - name: Publish sonicfield-oida
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: release/oida
          skip-existing: true
          verify-metadata: true
          attestations: true