|
| 1 | +# This GitHub workflow will publish the package to Pypi and create a new stable branch when releasing the master branch. |
| 2 | +# For more information see: |
| 3 | +# https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions |
| 4 | +# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ |
| 5 | + |
| 6 | +name: publish |
| 7 | + |
| 8 | +on: |
| 9 | + push: # When pushing a tag |
| 10 | + tags: |
| 11 | + - "*" |
| 12 | + - "!*a0" # Exclude initial tag for a new version |
| 13 | + |
| 14 | +jobs: |
| 15 | + publish: |
| 16 | + name: Build and publish to PyPI |
| 17 | + if: startsWith(github.ref, 'refs/tags') |
| 18 | + runs-on: ubuntu-latest |
| 19 | + # This workflow uses Pypi trusted publishing, see https://docs.pypi.org/trusted-publishers/ |
| 20 | + # Requirements: |
| 21 | + # - On the Pypi project, the GitHub repo must be defined as a trusted publisher |
| 22 | + # - On the GitHub repo, an environment 'pypi' must exist |
| 23 | + environment: pypi # For Pypi trusted publishing |
| 24 | + permissions: |
| 25 | + id-token: write # For Pypi trusted publishing |
| 26 | + contents: write # For creating GitHub release |
| 27 | + steps: |
| 28 | + |
| 29 | + #-------- Info gathering and checks |
| 30 | + - name: Set pushed tag |
| 31 | + id: set-tag |
| 32 | + uses: actions/github-script@v8 |
| 33 | + with: |
| 34 | + result-encoding: string |
| 35 | + script: | |
| 36 | + const result = "${{ github.ref }}".match("refs/tags/(.*)$")[1] |
| 37 | + console.log(result) |
| 38 | + return result |
| 39 | + - name: Check validity of pushed tag |
| 40 | + run: | |
| 41 | + if [[ ${{ steps.set-tag.outputs.result }} =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then |
| 42 | + echo "Pushed tag '${{ steps.set-tag.outputs.result }}' is valid"; |
| 43 | + else |
| 44 | + echo "Pushed tag '${{ steps.set-tag.outputs.result }}' is invalid (must be 'M.N.U')"; |
| 45 | + false; |
| 46 | + fi |
| 47 | + - name: Determine whether releasing the master branch |
| 48 | + id: set-is-master-branch |
| 49 | + uses: actions/github-script@v8 |
| 50 | + with: |
| 51 | + result-encoding: string |
| 52 | + script: | |
| 53 | + const resp = await github.rest.git.getRef({ |
| 54 | + owner: context.repo.owner, |
| 55 | + repo: context.repo.repo, |
| 56 | + ref: "heads/master", |
| 57 | + }) |
| 58 | + const result = (resp.data.object.sha == "${{ github.sha }}") |
| 59 | + console.log(result) |
| 60 | + return result |
| 61 | + env: |
| 62 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 63 | + - name: Determine name of stable branch for pushed tag |
| 64 | + id: set-stable-branch |
| 65 | + uses: actions/github-script@v8 |
| 66 | + with: |
| 67 | + result-encoding: string |
| 68 | + script: | |
| 69 | + const result = "stable_"+"${{ steps.set-tag.outputs.result }}".match("([0-9]+\.[0-9]+)\.")[1] |
| 70 | + console.log(result) |
| 71 | + return result |
| 72 | + - name: Determine whether releasing stable branch for pushed tag |
| 73 | + id: set-is-stable-branch |
| 74 | + uses: actions/github-script@v8 |
| 75 | + with: |
| 76 | + result-encoding: string |
| 77 | + script: | |
| 78 | + var resp |
| 79 | + try { |
| 80 | + resp = await github.rest.git.getRef({ |
| 81 | + owner: context.repo.owner, |
| 82 | + repo: context.repo.repo, |
| 83 | + ref: "heads/${{ steps.set-stable-branch.outputs.result }}", |
| 84 | + }) |
| 85 | + } |
| 86 | + catch(err) { |
| 87 | + console.log("false (stable branch does not exist: "+err+")") |
| 88 | + return false |
| 89 | + } |
| 90 | + const result = (resp.data.object.sha == "${{ github.sha }}") |
| 91 | + console.log(result) |
| 92 | + return result |
| 93 | + env: |
| 94 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 95 | + - name: Check released commit to be master branch or stable branch for pushed tag |
| 96 | + run: | |
| 97 | + if [[ ${{ steps.set-is-master-branch.outputs.result }} == 'false' && ${{ steps.set-is-stable-branch.outputs.result }} == 'false' ]]; then |
| 98 | + echo "Released commit is not 'master' or '${{ steps.set-stable-branch.outputs.result }}' branch"; |
| 99 | + false; |
| 100 | + fi |
| 101 | + - name: Set update version |
| 102 | + id: set-update-version |
| 103 | + uses: actions/github-script@v8 |
| 104 | + with: |
| 105 | + result-encoding: string |
| 106 | + script: | |
| 107 | + const result = "${{ steps.set-tag.outputs.result }}".match("[0-9]+\.[0-9]+\.([0-9]+)")[1] |
| 108 | + console.log(result) |
| 109 | + return result |
| 110 | + - name: Check update version to be 0 when releasing master branch |
| 111 | + if: ${{ steps.set-is-master-branch.outputs.result == 'true' }} |
| 112 | + run: | |
| 113 | + if [[ ${{ steps.set-update-version.outputs.result }} != '0' ]]; then |
| 114 | + echo "Update version '${{ steps.set-update-version.outputs.result }}' in tag '${{ steps.set-tag.outputs.result }}' is invalid (must be 0 when releasing master branch)"; |
| 115 | + false; |
| 116 | + fi |
| 117 | + - name: Check update version to be non-0 when releasing stable branch for pushed tag |
| 118 | + if: ${{ steps.set-is-stable-branch.outputs.result == 'true' }} |
| 119 | + run: | |
| 120 | + if [[ ${{ steps.set-update-version.outputs.result }} == '0' ]]; then |
| 121 | + echo "Update version '${{ steps.set-update-version.outputs.result }}' in tag '${{ steps.set-tag.outputs.result }}' is invalid (must be non-0 when releasing stable branch for pushed tag)"; |
| 122 | + false; |
| 123 | + fi |
| 124 | +
|
| 125 | + #-------- Setup of work environment |
| 126 | + - name: Checkout repo |
| 127 | + uses: actions/checkout@v5 |
| 128 | + with: |
| 129 | + # fetch-depth 0 checks out all history for all branches and tags. |
| 130 | + # This is needed to get the authors from git. |
| 131 | + fetch-depth: 0 |
| 132 | + - name: Set up Python |
| 133 | + uses: actions/setup-python@v6 |
| 134 | + with: |
| 135 | + python-version: "3.13" |
| 136 | + - name: Development setup |
| 137 | + run: | |
| 138 | + make develop |
| 139 | + - name: Display Python packages |
| 140 | + run: | |
| 141 | + pip list |
| 142 | +
|
| 143 | + #-------- Publishing of package |
| 144 | + - name: Build the distribution |
| 145 | + run: | |
| 146 | + make build |
| 147 | + - name: Display the distribution directory |
| 148 | + run: | |
| 149 | + ls -l dist |
| 150 | + - name: Publish distribution to PyPI |
| 151 | + if: startsWith(github.ref, 'refs/tags') |
| 152 | + uses: pypa/gh-action-pypi-publish@release/v1 |
| 153 | + with: |
| 154 | + packages_dir: dist |
| 155 | + # Pypi trusted publishing requires to have no password |
| 156 | + |
| 157 | + #-------- Creation of Github release |
| 158 | + - name: Determine whether release on Github exists for the pushed tag |
| 159 | + id: set-release-exists |
| 160 | + uses: octokit/request-action@v2.x |
| 161 | + with: |
| 162 | + route: GET /repos/${{ github.repository }}/releases/tags/${{ steps.set-tag.outputs.result }} |
| 163 | + continue-on-error: true |
| 164 | + env: |
| 165 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 166 | + - name: Create release on Github for the pushed tag if it does not exist |
| 167 | + if: ${{ steps.set-release-exists.outputs.status == 404 }} |
| 168 | + uses: octokit/request-action@v2.x |
| 169 | + with: |
| 170 | + route: POST /repos/${{ github.repository }}/releases |
| 171 | + env: |
| 172 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 173 | + INPUT_TAG_NAME: ${{ steps.set-tag.outputs.result }} |
| 174 | + INPUT_NAME: "Release ${{ steps.set-tag.outputs.result }}" |
| 175 | + INPUT_BODY: "Change log https://pywbem.readthedocs.io/en/${{ steps.set-tag.outputs.result }}/changes.html" |
| 176 | + |
| 177 | + #-------- Creation of stable branch |
| 178 | + # Note: This does not seem to depend on the disablement of the "Restrict pushes |
| 179 | + # that create matching branches" setting in the branch protection rules for stable_*. |
| 180 | + # It is possible that this fails with HTTP 422, for unknown reasons. |
| 181 | + - name: Create new stable branch when releasing master branch |
| 182 | + if: steps.set-is-master-branch.outputs.result == 'true' |
| 183 | + id: create-stable-branch |
| 184 | + uses: actions/github-script@v8 |
| 185 | + with: |
| 186 | + script: | |
| 187 | + github.rest.git.createRef({ |
| 188 | + owner: context.repo.owner, |
| 189 | + repo: context.repo.repo, |
| 190 | + ref: "refs/heads/${{ steps.set-stable-branch.outputs.result }}", |
| 191 | + sha: "${{ github.sha }}", |
| 192 | + }) |
| 193 | + env: |
| 194 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 195 | + continue-on-error: true |
| 196 | + - name: Wait some time if HTTP error 422 |
| 197 | + if: steps.set-is-master-branch.outputs.result == 'true' && steps.create-stable-branch.outputs.status == 422 |
| 198 | + run: | |
| 199 | + sleep 10 |
| 200 | + - name: Retry create new stable branch when releasing master branch if HTTP error 422 |
| 201 | + if: steps.set-is-master-branch.outputs.result == 'true' && steps.create-stable-branch.outputs.status == 422 |
| 202 | + id: create-stable-branch-2 |
| 203 | + uses: actions/github-script@v8 |
| 204 | + with: |
| 205 | + script: | |
| 206 | + github.rest.git.createRef({ |
| 207 | + owner: context.repo.owner, |
| 208 | + repo: context.repo.repo, |
| 209 | + ref: "refs/heads/${{ steps.set-stable-branch.outputs.result }}", |
| 210 | + sha: "${{ github.sha }}", |
| 211 | + }) |
| 212 | + env: |
| 213 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 214 | + continue-on-error: true |
| 215 | + - name: Handle HTTP error 422 from creating the new stable branch |
| 216 | + if: steps.set-is-master-branch.outputs.result == 'true' && steps.create-stable-branch-2.outputs.status == 422 |
| 217 | + run: | |
| 218 | + echo "Error: Creating the new stable branch ${{ steps.set-stable-branch.outputs.result }} failed twice, but the publish still succeeded. Create the new stable branch manually:" |
| 219 | + echo "git checkout master" |
| 220 | + echo "git pull" |
| 221 | + echo "git checkout -b ${{ steps.set-stable-branch.outputs.result }}" |
| 222 | + echo "git push --set-upstream origin ${{ steps.set-stable-branch.outputs.result }}" |
| 223 | + false |
0 commit comments