Skip to content

Commit 0990d35

Browse files
zsolzsol
committed
Separate versions publishing privileges from release
1 parent 96a589a commit 0990d35

2 files changed

Lines changed: 111 additions & 69 deletions

File tree

‎.github/workflows/publish-versions.yml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# Publish python-build-standalone version information to the versions repository.
2+
name: publish-versions
3+
4+
on:
5+
workflow_call:
6+
inputs:
7+
tag:
8+
required: true
9+
type: string
10+
workflow_dispatch:
11+
inputs:
12+
tag:
13+
description: "Release tag to publish (e.g. 20260127)"
14+
required: true
15+
type: string
16+
dry-run:
17+
description: "Only generate metadata, skip PR creation"
18+
required: false
19+
type: boolean
20+
default: true
21+
22+
permissions: {}
23+
24+
jobs:
25+
publish-versions:
26+
runs-on: ubuntu-latest
27+
env:
28+
TAG: ${{ inputs.tag }}
29+
steps:
30+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31+
with:
32+
persist-credentials: false
33+
34+
- name: "Install uv"
35+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
36+
37+
- name: "Download SHA256SUMS"
38+
env:
39+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
40+
run: |
41+
mkdir -p dist
42+
gh release download "$TAG" --dir dist --pattern "SHA256SUMS"
43+
44+
- name: "Generate versions metadata"
45+
env:
46+
GITHUB_EVENT_INPUTS_TAG: ${{ inputs.tag }}
47+
GITHUB_REPOSITORY: ${{ github.repository }}
48+
run: uv run generate-version-metadata.py > dist/versions.ndjson
49+
50+
- name: "Validate metadata"
51+
run: |
52+
echo "Generated $(wc -l < dist/versions.ndjson) version entries"
53+
head -c 1000 dist/versions.ndjson
54+
55+
- name: "Set branch name"
56+
if: inputs.dry-run != true
57+
run: echo "BRANCH_NAME=update-versions-$TAG-$(date +%s)" >> $GITHUB_ENV
58+
59+
- name: "Clone versions repo"
60+
if: inputs.dry-run != true
61+
run: git clone https://${{ secrets.ASTRAL_VERSIONS_PAT }}@github.com/astral-sh/versions.git astral-versions
62+
63+
- name: "Update versions"
64+
if: inputs.dry-run != true
65+
run: cat dist/versions.ndjson | uv run astral-versions/scripts/insert-versions.py --name python-build-standalone
66+
67+
- name: "Commit versions"
68+
if: inputs.dry-run != true
69+
working-directory: astral-versions
70+
run: |
71+
git config user.name "astral-versions-bot"
72+
git config user.email "176161322+astral-versions-bot@users.noreply.github.com"
73+
74+
git checkout -b "$BRANCH_NAME"
75+
git add -A
76+
git commit -m "Update python-build-standalone to $TAG"
77+
78+
- name: "Create Pull Request"
79+
if: inputs.dry-run != true
80+
working-directory: astral-versions
81+
env:
82+
GITHUB_TOKEN: ${{ secrets.ASTRAL_VERSIONS_PAT }}
83+
run: |
84+
pull_request_title="Update python-build-standalone versions for $TAG"
85+
86+
gh pr list --state open --json title --jq ".[] | select(.title == \"$pull_request_title\") | .number" | \
87+
xargs -I {} gh pr close {}
88+
89+
git push origin "$BRANCH_NAME"
90+
91+
gh pr create --base main --head "$BRANCH_NAME" \
92+
--title "$pull_request_title" \
93+
--body "Automated versions update for $TAG" \
94+
--label "automation"
95+
96+
- name: "Merge Pull Request"
97+
if: inputs.dry-run != true
98+
working-directory: astral-versions
99+
env:
100+
GITHUB_TOKEN: ${{ secrets.ASTRAL_VERSIONS_PAT }}
101+
run: |
102+
# Wait for PR to be created before merging
103+
sleep 10
104+
gh pr merge --squash "$BRANCH_NAME"

‎.github/workflows/release.yml‎

Lines changed: 7 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -113,72 +113,10 @@ jobs:
113113
${VERSION}
114114
fi
115115
116-
- name: Generate versions metadata
117-
if: ${{ github.event.inputs.dry-run == 'false' }}
118-
env:
119-
GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
120-
GITHUB_REPOSITORY: ${{ github.repository }}
121-
run: uv run generate-version-metadata.py > dist/versions.ndjson
122-
123-
- name: Validate metadata
124-
if: ${{ github.event.inputs.dry-run == 'false' }}
125-
run: |
126-
echo "Generated $(wc -l < dist/versions.ndjson) version entries"
127-
head -c 1000 dist/versions.ndjson
128-
129-
- name: Set branch name
130-
if: ${{ github.event.inputs.dry-run == 'false' }}
131-
env:
132-
TAG: ${{ github.event.inputs.tag }}
133-
run: echo "BRANCH_NAME=update-versions-$TAG-$(date +%s)" >> $GITHUB_ENV
134-
135-
- name: Clone versions repo
136-
if: ${{ github.event.inputs.dry-run == 'false' }}
137-
run: git clone https://${{ secrets.ASTRAL_VERSIONS_PAT }}@github.com/astral-sh/versions.git astral-versions
138-
139-
- name: Update versions
140-
if: ${{ github.event.inputs.dry-run == 'false' }}
141-
run: cat dist/versions.ndjson | uv run astral-versions/scripts/insert-versions.py --name python-build-standalone
142-
143-
- name: Commit versions
144-
if: ${{ github.event.inputs.dry-run == 'false' }}
145-
env:
146-
TAG: ${{ github.event.inputs.tag }}
147-
working-directory: astral-versions
148-
run: |
149-
git config user.name "astral-versions-bot"
150-
git config user.email "176161322+astral-versions-bot@users.noreply.github.com"
151-
152-
git checkout -b "$BRANCH_NAME"
153-
git add -A
154-
git commit -m "Update python-build-standalone to $TAG"
155-
156-
- name: Create Pull Request
157-
if: ${{ github.event.inputs.dry-run == 'false' }}
158-
env:
159-
TAG: ${{ github.event.inputs.tag }}
160-
GH_TOKEN: ${{ secrets.ASTRAL_VERSIONS_PAT }}
161-
working-directory: astral-versions
162-
run: |
163-
pull_request_title="Update python-build-standalone versions for $TAG"
164-
165-
gh pr list --state open --json title --jq ".[] | select(.title == \"$pull_request_title\") | .number" | \
166-
xargs -I {} gh pr close {}
167-
168-
git push origin "$BRANCH_NAME"
169-
170-
gh pr create --base main --head "$BRANCH_NAME" \
171-
--title "$pull_request_title" \
172-
--body "Automated versions update for $TAG" \
173-
--label "automation"
174-
175-
- name: Merge Pull Request
176-
if: ${{ github.event.inputs.dry-run == 'false' }}
177-
env:
178-
GH_TOKEN: ${{ secrets.ASTRAL_VERSIONS_PAT }}
179-
working-directory: astral-versions
180-
run: |
181-
# Wait for PR to be created before merging
182-
sleep 10
183-
gh pr merge --squash "$BRANCH_NAME"
184-
116+
publish-versions:
117+
needs: release
118+
if: ${{ github.event.inputs.dry-run == 'false' }}
119+
uses: ./.github/workflows/publish-versions.yml
120+
with:
121+
tag: ${{ github.event.inputs.tag }}
122+
secrets: inherit

0 commit comments

Comments
 (0)