ci-tooling/.github/workflows/python-release.yml at main · provide-io/ci-tooling · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
name: 'Reusable Python Release'

on:
  workflow_call:
    inputs:
      python-version:
        description: 'Python version to use'
        type: string
        default: '3.11'
      uv-version:
        description: 'UV version to use'
        type: string
        default: '0.11.3'
      build-backend:
        description: 'Build backend (uv, build)'
        type: string
        default: 'uv'
      prerelease:
        description: 'Mark as prerelease'
        type: boolean
        default: false
      run-tests:
        description: 'Run tests before release'
        type: boolean
        default: true
      parallel-tests:
        description: 'Run tests in parallel with pytest-xdist'
        type: boolean
        default: true
      create-github-release:
        description: 'Create a GitHub release from the built artifacts. Set false when the caller was triggered by an existing release.'
        type: boolean
        default: true

env:
  FORCE_COLOR: "1"
  UV_SYSTEM_PYTHON: "1"

# Publishing (TestPyPI + PyPI) intentionally stays in caller workflows:
# PyPI Trusted Publishing matches on OIDC job_workflow_ref, which points at
# the workflow that actually runs the publish action. If publish ran here in
# the reusable, every PyPI project would need its trusted publisher pointed
# at provide-io/ci-tooling/python-release.yml, defeating per-repo isolation.
# Callers consume the `release-artifacts` artifact from this workflow's build
# job and run their own publish-testpypi / publish-pypi / sign-and-upload.

jobs:
  # ==================================================================================
  # 🧪 Pre-release Tests
  # ==================================================================================
  pre-release-tests:
    name: 🧪 Pre-release Tests
    if: inputs.run-tests
    runs-on: ubuntu-24.04
    steps:
      # Fetch repo sources for test + quality runs
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0

      # Install the requested Python + uv toolchain via ci-tooling helper
      - name: 🐍 Setup Python Environment
        uses: provide-io/ci-tooling/actions/setup-python-env@main
        with:
          python-version: ${{ inputs.python-version }}
          uv-version: ${{ inputs.uv-version }}

      # Lint/type-check using shared quality composite
      - name: 🎨 Quality Checks
        uses: provide-io/ci-tooling/actions/python-quality@main

      # Run the test suite; coverage gate intentionally disabled for release flow
      - name: 🧪 Run Tests
        uses: provide-io/ci-tooling/actions/python-test@main
        with:
          coverage-threshold: 0
          parallel: ${{ inputs.parallel-tests }}

  # ==================================================================================
  # 🏗️ Build Package
  # ==================================================================================
  build:
    name: 🏗️ Build Package
    needs: [pre-release-tests]
    if: always() && (needs.pre-release-tests.result == 'success' || !inputs.run-tests)
    runs-on: ubuntu-24.04
    steps:
      # Full clone needed for version extraction from tags
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0

      # Build environment: no dev group since we're only producing wheels/sdist
      - name: 🐍 Setup Python Environment
        uses: provide-io/ci-tooling/actions/setup-python-env@main
        with:
          python-version: ${{ inputs.python-version }}
          uv-version: ${{ inputs.uv-version }}
          install-group: ''

      # Produce wheel + sdist into dist/
      - name: 🏗️ Build Package
        uses: provide-io/ci-tooling/actions/python-build@main
        with:
          build-backend: ${{ inputs.build-backend }}

      # Share artifacts with downstream caller jobs (publish-testpypi, publish-pypi, etc.)
      - name: 📤 Upload Build Artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
        with:
          name: release-artifacts
          path: dist/*
          retention-days: 30

  # ==================================================================================
  # 🏷️ Create GitHub Release (optional)
  # ==================================================================================
  github-release:
    name: 🏷️ GitHub Release
    needs: [build]
    # Skip when the caller was triggered by an already-existing release
    if: always() && needs.build.result == 'success' && inputs.create-github-release
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      # Full clone so release-notes generation can walk history
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0

      # Pull the just-built artifacts for attaching to the release
      - name: 📦 Download Build Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: release-artifacts
          path: dist/

      # Create the GH release tagged vX.Y.Z with artifacts attached
      - name: 🏷️ Create GitHub Release
        uses: provide-io/ci-tooling/actions/github-release@main
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          artifacts-path: dist/
          prerelease: ${{ inputs.prerelease }}

  # ==================================================================================
  # 🚧 Publishing Gate
  # ==================================================================================
  publishing-gate:
    name: 🚧 Publishing Gate
    needs: [build, github-release]
    # Run whenever the build succeeded; github-release may be skipped
    if: always() && needs.build.result == 'success'
    runs-on: ubuntu-24.04
    steps:
      # Summary for humans; callers use `needs: [release]` on this workflow to gate publish-testpypi / publish-pypi
      - name: 📋 Report Gate Status
        env:
          R_BUILD: ${{ needs.build.result }}
          R_GHREL: ${{ needs.github-release.result }}
        run: |
          printf '## 🚧 Publishing Gate\n\nbuild=%s  github-release=%s\n\nArtifacts (release-artifacts) ready for caller publish.\n' \
            "$R_BUILD" "$R_GHREL" >> "$GITHUB_STEP_SUMMARY"