|
| 1 | +name: Publish conda package |
| 2 | + |
| 3 | +"on": |
| 4 | + push: |
| 5 | + tags: |
| 6 | + - 'v[0-9]+.[0-9]+.[0-9]+' |
| 7 | + |
| 8 | +permissions: |
| 9 | + contents: read |
| 10 | + |
| 11 | +jobs: |
| 12 | + publish: |
| 13 | + runs-on: ubuntu-latest |
| 14 | + |
| 15 | + # Requires an 'anaconda-publish' environment configured under repo |
| 16 | + # Settings → Environments with required reviewers and the |
| 17 | + # ANACONDA_API_TOKEN secret. |
| 18 | + environment: |
| 19 | + name: anaconda-publish |
| 20 | + url: https://anaconda.org/tigergraph/pytigergraph |
| 21 | + |
| 22 | + steps: |
| 23 | + - name: Checkout source at tag |
| 24 | + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 |
| 25 | + |
| 26 | + - name: Validate tag is strict semver |
| 27 | + id: tag |
| 28 | + run: | |
| 29 | + TAG="${GITHUB_REF#refs/tags/}" |
| 30 | + if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then |
| 31 | + echo "::error::Tag '$TAG' is not a strict v<major>.<minor>.<patch> tag." |
| 32 | + exit 1 |
| 33 | + fi |
| 34 | + echo "version=${TAG#v}" >> "$GITHUB_OUTPUT" |
| 35 | +
|
| 36 | + - name: Set up Python |
| 37 | + uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1 |
| 38 | + with: |
| 39 | + python-version: '3.11' |
| 40 | + |
| 41 | + - name: Verify pyproject.toml version matches tag |
| 42 | + run: | |
| 43 | + PROJ_VER=$(python -c "import tomllib; print(tomllib.loads(open('pyproject.toml','rb').read().decode())['project']['version'])") |
| 44 | + TAG_VER="${{ steps.tag.outputs.version }}" |
| 45 | + if [[ "$PROJ_VER" != "$TAG_VER" ]]; then |
| 46 | + echo "::error::pyproject.toml version ($PROJ_VER) does not match tag version ($TAG_VER)." |
| 47 | + exit 1 |
| 48 | + fi |
| 49 | +
|
| 50 | + - name: Build sdist locally |
| 51 | + run: | |
| 52 | + python -m pip install --upgrade pip build |
| 53 | + python -m build --sdist |
| 54 | +
|
| 55 | + # Build conda from the local sdist to avoid the PyPI propagation race. |
| 56 | + - name: Rewrite recipe to build from local sdist |
| 57 | + run: | |
| 58 | + VERSION="${{ steps.tag.outputs.version }}" |
| 59 | + SDIST="$PWD/dist/pytigergraph-${VERSION}.tar.gz" |
| 60 | + [[ -f "$SDIST" ]] || { echo "::error::Sdist not found at $SDIST"; exit 1; } |
| 61 | + SHA=$(shasum -a 256 "$SDIST" | awk '{print $1}') |
| 62 | + python - <<PY |
| 63 | + import pathlib, re |
| 64 | + p = pathlib.Path("pytigergraph-recipe/recipe/meta.yaml") |
| 65 | + t = p.read_text() |
| 66 | + t = re.sub(r'^\{% set version = ".*" %\}', f'{{% set version = "${{ steps.tag.outputs.version }}" %}}', t, count=1, flags=re.M) |
| 67 | + t = re.sub( |
| 68 | + r'^source:\n(?: .*\n)+', |
| 69 | + f'source:\n url: file://${SDIST}\n sha256: ${SHA}\n', |
| 70 | + t, count=1, flags=re.M, |
| 71 | + ) |
| 72 | + p.write_text(t) |
| 73 | + PY |
| 74 | +
|
| 75 | + - name: Set up Miniconda |
| 76 | + uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca # v3.0.4 |
| 77 | + with: |
| 78 | + auto-update-conda: false |
| 79 | + python-version: '3.11' |
| 80 | + channels: conda-forge |
| 81 | + channel-priority: strict |
| 82 | + |
| 83 | + - name: Install conda-build |
| 84 | + shell: bash -el {0} |
| 85 | + run: conda install -y -n base conda-build |
| 86 | + |
| 87 | + - name: Build conda package |
| 88 | + shell: bash -el {0} |
| 89 | + run: | |
| 90 | + conda build pytigergraph-recipe/recipe --output-folder conda-out --no-anaconda-upload |
| 91 | +
|
| 92 | + - name: Upload to anaconda.org |
| 93 | + env: |
| 94 | + ANACONDA_API_TOKEN: ${{ secrets.ANACONDA_API_TOKEN }} |
| 95 | + run: | |
| 96 | + if [[ -z "$ANACONDA_API_TOKEN" ]]; then |
| 97 | + echo "::error::ANACONDA_API_TOKEN is not set." |
| 98 | + exit 1 |
| 99 | + fi |
| 100 | + # anaconda-client via pip; conda-installed binary doesn't reliably reach PATH here. |
| 101 | + pip install --quiet anaconda-client |
| 102 | + PKG=$(ls conda-out/noarch/pytigergraph-*.conda 2>/dev/null | head -1) |
| 103 | + [[ -n "$PKG" ]] || { echo "::error::No conda package found"; exit 1; } |
| 104 | + # Token flows via env var; --token rejects JWTs at argparse. |
| 105 | + anaconda upload --user tigergraph --label main "$PKG" |
0 commit comments