|
| 1 | +name: Release |
| 2 | + |
| 3 | +# Publishes one VisCy package to PyPI when a maintainer publishes a GitHub Release. |
| 4 | +# The tag on the Release selects the package. Each package is versioned independently |
| 5 | +# The prefix isolates its tag history, so versions need not match across packages: |
| 6 | +# v2.1.0 -> viscy (umbrella) |
| 7 | +# viscy-data-v0.5.3 -> viscy-data (library) |
| 8 | +# viscy-models-v1.4.0 -> viscy-models |
| 9 | +# viscy-transforms-v0.9.1 -> viscy-transforms |
| 10 | +# viscy-utils-v0.2.7 -> viscy-utils |
| 11 | +# airtable-utils-v0.1.0 -> airtable-utils (application) |
| 12 | +# cytoland-v0.3.0 -> cytoland |
| 13 | +# dynacell-v0.2.0 -> dynacell |
| 14 | +# dynaclr-v0.1.0 -> dynaclr |
| 15 | +# viscy-qc-v0.1.0 -> viscy-qc |
| 16 | +# Setup (PyPI trusted publishers + GitHub environments): see .github/RELEASE_SETUP.md |
| 17 | +# Design rationale: see .github/RELEASE_CI_PLAN.md |
| 18 | + |
| 19 | +on: |
| 20 | + release: |
| 21 | + types: [published] |
| 22 | + |
| 23 | +permissions: {} |
| 24 | + |
| 25 | +concurrency: |
| 26 | + group: release-${{ github.event.release.tag_name }} |
| 27 | + cancel-in-progress: false |
| 28 | + |
| 29 | +jobs: |
| 30 | + # Route the Release tag -> {package, version}. Separate job because `environment.name` |
| 31 | + # on the publish job is resolved at the job level and can only read `needs.*` outputs. |
| 32 | + parse: |
| 33 | + runs-on: ubuntu-latest |
| 34 | + timeout-minutes: 5 |
| 35 | + outputs: |
| 36 | + package: ${{ steps.route.outputs.package }} |
| 37 | + version: ${{ steps.route.outputs.version }} |
| 38 | + steps: |
| 39 | + - name: Check out (for the routing script) |
| 40 | + uses: actions/checkout@v6 |
| 41 | + - name: Route tag to package |
| 42 | + id: route |
| 43 | + env: |
| 44 | + TAG: ${{ github.event.release.tag_name }} # untrusted input via env, never inline in run: |
| 45 | + run: bash .github/scripts/route-tag.sh "$TAG" >> "$GITHUB_OUTPUT" |
| 46 | + |
| 47 | + release: |
| 48 | + needs: parse |
| 49 | + runs-on: ubuntu-latest |
| 50 | + timeout-minutes: 15 |
| 51 | + environment: |
| 52 | + name: pypi-${{ needs.parse.outputs.package }} # per-package OIDC isolation (see RELEASE_SETUP.md) |
| 53 | + url: https://pypi.org/project/${{ needs.parse.outputs.package }}/${{ needs.parse.outputs.version }}/ |
| 54 | + permissions: |
| 55 | + id-token: write # OIDC trusted publishing |
| 56 | + contents: write # attach built dists to the GitHub Release (post-publish) |
| 57 | + env: |
| 58 | + PACKAGE: ${{ needs.parse.outputs.package }} |
| 59 | + VERSION: ${{ needs.parse.outputs.version }} |
| 60 | + steps: |
| 61 | + - name: Check out the release tag |
| 62 | + uses: actions/checkout@v6 |
| 63 | + with: |
| 64 | + ref: ${{ github.event.release.tag_name }} |
| 65 | + fetch-depth: 0 # full history … |
| 66 | + fetch-tags: true # … and tags so uv-dynamic-versioning can resolve the version |
| 67 | + |
| 68 | + - name: Install uv |
| 69 | + uses: astral-sh/setup-uv@v8 |
| 70 | + |
| 71 | + # Build BOTH from source. Plain `uv build` chains sdist -> wheel-from-sdist, and the |
| 72 | + # unpacked sdist has no .git, so uv-dynamic-versioning would fall back to 0.0.0 for the |
| 73 | + # wheel. `--sdist --wheel` builds each directly from the checkout. `--no-sources` drops |
| 74 | + # workspace path rewrites so deps resolve as normal PyPI packages (matches `pypa/build`). |
| 75 | + - name: Build sdist and wheel |
| 76 | + run: uv build --package "$PACKAGE" --sdist --wheel --no-sources --out-dir dist |
| 77 | + |
| 78 | + - name: Check distribution metadata |
| 79 | + run: uvx twine check dist/* |
| 80 | + |
| 81 | + # Cross-check the built version against the tag. The sdist is always named |
| 82 | + # `<name>-<version>.tar.gz`, so an exact suffix match catches both the |
| 83 | + # uv-dynamic-versioning 0.0.0 fallback and any tag/build drift — with no |
| 84 | + # substring false positives (e.g. version 10.0.0 vs the 0.0.0 fallback). |
| 85 | + - name: Verify built version matches the tag |
| 86 | + run: | |
| 87 | + set -euo pipefail |
| 88 | + ls -1 dist/ |
| 89 | + if ! compgen -G "dist/*-${VERSION}.tar.gz" >/dev/null; then |
| 90 | + echo "::error::no sdist matches tag version '${VERSION}' — version derivation likely failed" |
| 91 | + exit 1 |
| 92 | + fi |
| 93 | +
|
| 94 | + - name: Publish to PyPI |
| 95 | + uses: pypa/gh-action-pypi-publish@release/v1 |
| 96 | + # attestations: true is the default on >=1.11 -> PEP 740 provenance, no extra config |
| 97 | + |
| 98 | + - name: Attach distributions to the GitHub Release |
| 99 | + env: |
| 100 | + TAG: ${{ github.event.release.tag_name }} |
| 101 | + GH_TOKEN: ${{ github.token }} |
| 102 | + run: gh release upload "$TAG" dist/* --clobber --repo "$GITHUB_REPOSITORY" |
0 commit comments