secbot/.github/workflows/release.yml at 3e8ab3b5708f095ad99a09f71e7d4b9d60e4ca51 · iammm0/secbot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
name: Release

on:
  push:
    branches:
      - main
      - beta
  workflow_dispatch:
    inputs:
      ref:
        description: Git ref to build (tag/sha/branch). Leave empty to use current.
        required: false
        default: ""

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    outputs:
      released: ${{ steps.semantic.outputs.released }}
      version: ${{ steps.semantic.outputs.version }}
      tag: ${{ steps.semantic.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Python Semantic Release
        id: semantic
        if: github.event_name == 'push'
        uses: python-semantic-release/python-semantic-release@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}

  publish-npm:
    needs: release
    runs-on: ubuntu-latest
    if: ((github.event_name == 'push' && needs.release.outputs.released == 'true') || github.event_name == 'workflow_dispatch') && hashFiles('package.json') != ''
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref || needs.release.outputs.tag || github.sha }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          registry-url: "https://registry.npmjs.org"

      - name: Publish to npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public

  publish-pypi:
    needs: release
    runs-on: ubuntu-latest
    if: (github.event_name == 'push' && needs.release.outputs.released == 'true') || github.event_name == 'workflow_dispatch'
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref || needs.release.outputs.tag || github.sha }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      # 按 CHANGELOG 刷新 docs/releases/ 下的版本说明（与仓库 scripts/、secbot_agent/ 结构无关，在仓库根目录执行即可）
      - name: Refresh versioned release docs
        run: |
          python -m utils.release_docs version-docs --changelog CHANGELOG.md --output-dir docs/releases

      - name: Build package
        run: |
          python -m pip install --upgrade pip
          python -m pip install build twine
          python -m build
          python -m twine check dist/*

      # 仓库 Settings → Secrets：PYPI_PASSWORD = PyPI 上创建的 API token 字符串（勿用 .pypirc）
      - name: Upload to PyPI
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
        run: |
          python -m twine upload --non-interactive --skip-existing dist/*