agent-framework/.github/workflows/python-release.yml at main · microsoft/agent-framework · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
name: Python - Validate Release

on:
  release:
    types: [published]
  pull_request:
    branches: ["main", "feature*"]
    paths:
      - "python/.github/release-*.json"
      - "python/pyproject.toml"
      - "python/packages/*/pyproject.toml"
      - "python/scripts/prepare_release.py"
      - "python/scripts/tests/test_prepare_release.py"
      - "python/scripts/dependencies/**"
      - ".github/workflows/python-release.yml"

# Azure DevOps owns build, ESRP approval/publication, exact asset upload, and the
# final draft -> published transition. This workflow must never write releases
# or obtain an identity that can start an Azure DevOps run.
permissions:
  contents: read

jobs:
  validate:
    if: github.event_name == 'pull_request' || startsWith(github.event.release.tag_name, 'python-')
    name: Validate Python release manifest
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: python
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # A release must validate the exact tagged commit, never current main.
          ref: ${{ github.event_name == 'release' && format('refs/tags/{0}', github.event.release.tag_name) || github.sha }}
          fetch-depth: 0
          persist-credentials: false
      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
        with:
          version-file: "python/pyproject.toml"
          enable-cache: true
      - name: Test release tooling
        run: >-
          uv run --no-project --python 3.12 --with packaging==26.3 --with rich --with pytest==9.1.1
          python -m pytest -c /dev/null -p no:cacheprovider
          scripts/tests/test_prepare_release.py scripts/dependencies/tests/test_dependency_bounds_release.py -q
      - name: Check reviewed batch in PR
        if: github.event_name == 'pull_request'
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: >-
          uv run --no-project --python 3.12 --with packaging==26.3 --with rich
          python -m scripts.prepare_release --check --ci --base-ref "$BASE_SHA"
      - name: Check published tag contract
        if: github.event_name == 'release'
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: >-
          uv run --no-project --python 3.12 --with packaging==26.3 --with rich
          python -m scripts.prepare_release --check --tag "$RELEASE_TAG"