|
1 | 1 | name: Publish |
2 | 2 |
|
| 3 | +# What reaches PyPI is decided here and in the `pypi` environment, which |
| 4 | +# setup_repo.py makes deployable from master only. Both triggers run with |
| 5 | +# master as their ref, so the checks below are always master's own; a run from |
| 6 | +# any other branch is refused the environment before it can publish. |
3 | 7 | on: |
4 | 8 | workflow_run: |
5 | 9 | workflows: ["Release Please"] |
6 | 10 | types: [completed] |
| 11 | + # A manual publish, from master: gh workflow run publish.yml -f tag=<tag> |
7 | 12 | workflow_dispatch: |
8 | 13 | inputs: |
9 | 14 | tag: |
10 | | - description: "Release tag to publish (e.g. {{ project_slug }}-v0.1.0 or v0.1.0)" |
| 15 | + description: "Release tag to publish (e.g. {{ project_slug }}-v0.1.0)" |
11 | 16 | required: true |
12 | 17 |
|
13 | 18 | permissions: |
14 | 19 | contents: read |
15 | | - id-token: write # Trusted Publisher (PyPI OIDC) |
16 | 20 |
|
17 | 21 | jobs: |
18 | 22 | check: |
19 | | - name: Check release tag |
| 23 | + name: Check release |
20 | 24 | if: > |
21 | 25 | github.event_name == 'workflow_dispatch' || |
22 | 26 | (github.event.workflow_run.conclusion == 'success' && |
| 27 | + github.event.workflow_run.event == 'push' && |
23 | 28 | github.event.workflow_run.head_branch == 'master') |
24 | 29 | runs-on: ubuntu-latest |
| 30 | + timeout-minutes: 60 |
| 31 | + permissions: |
| 32 | + contents: read |
| 33 | + actions: read # the CI run on the released commit |
25 | 34 | outputs: |
26 | | - tag: ${% raw %}{{ steps.tag.outputs.tag }}{% endraw %} |
| 35 | + tag: ${% raw %}{{ steps.release.outputs.tag }}{% endraw %} |
| 36 | + sha: ${% raw %}{{ steps.release.outputs.sha }}{% endraw %} |
27 | 37 | steps: |
28 | 38 | - uses: actions/checkout@v7 |
29 | 39 | with: |
30 | | - ref: ${% raw %}{{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.workflow_run.head_sha }}{% endraw %} |
31 | | - fetch-tags: true |
| 40 | + fetch-depth: 0 # master's history and every tag |
32 | 41 |
|
33 | | - - name: Resolve tag |
34 | | - id: tag |
35 | | - run: | |
36 | | - if [ "${% raw %}{{ github.event_name }}{% endraw %}" = "workflow_dispatch" ]; then |
37 | | - echo "tag=${% raw %}{{ inputs.tag }}{% endraw %}" >> "$GITHUB_OUTPUT" |
| 42 | + # The tag names a commit; it is never the ref this run starts from. It has |
| 43 | + # to be on master, and the version it carries has to be the one committed |
| 44 | + # in __version__.py -- the artifacts are built from that file, so a tag |
| 45 | + # that disagrees with it is a mistake to stop on, not to paper over. |
| 46 | + - name: Resolve the release tag |
| 47 | + id: release |
| 48 | + env: |
| 49 | + EVENT: ${% raw %}{{ github.event_name }}{% endraw %} |
| 50 | + REF: ${% raw %}{{ github.ref }}{% endraw %} |
| 51 | + INPUT_TAG: ${% raw %}{{ inputs.tag }}{% endraw %} |
| 52 | + PUSHED_SHA: ${% raw %}{{ github.event.workflow_run.head_sha }}{% endraw %} |
| 53 | + # Both tag conventions, the component-prefixed one and the bare one, |
| 54 | + # so a Release Please config change cannot silently stop publishing. |
| 55 | + TAG_PATTERN: '^({{ project_slug }}-)?v[0-9][0-9A-Za-z.+-]*$' |
| 56 | + TAG_PREFIX: "{{ project_slug }}-" |
| 57 | + VERSION_FILE: "{{ package_name }}/__version__.py" |
| 58 | + run: {% raw %}| |
| 59 | + if [ "$EVENT" = workflow_dispatch ]; then |
| 60 | + if [ "$REF" != refs/heads/master ]; then |
| 61 | + echo "::error::Publish from master, not $REF: gh workflow run publish.yml --ref master -f tag=<tag>" |
| 62 | + exit 1 |
| 63 | + fi |
| 64 | + if [[ ! "$INPUT_TAG" =~ $TAG_PATTERN ]]; then |
| 65 | + echo "::error::'$INPUT_TAG' is not a release tag of this project" |
| 66 | + exit 1 |
| 67 | + fi |
| 68 | + TAG=$INPUT_TAG |
| 69 | + if ! SHA=$(git rev-parse -q --verify "refs/tags/$TAG^{commit}"); then |
| 70 | + echo "::error::There is no tag $TAG" |
| 71 | + exit 1 |
| 72 | + fi |
38 | 73 | else |
39 | | - # Accept both tag conventions: the component-prefixed one and the |
40 | | - # bare one, so a Release Please config change cannot silently stop |
41 | | - # publishing. |
42 | | - TAG=$(git tag --points-at HEAD | grep -E '^({{ project_slug }}-)?v[0-9]' | head -1) |
43 | | - echo "tag=$TAG" >> "$GITHUB_OUTPUT" |
| 74 | + SHA=$PUSHED_SHA |
| 75 | + TAG=$(git tag --points-at "$SHA" | grep -E "$TAG_PATTERN" | head -1 || true) |
44 | 76 | if [ -z "$TAG" ]; then |
45 | | - echo "No release tag on this commit — skipping publish." |
46 | | - else |
47 | | - echo "Will publish $TAG" |
| 77 | + echo "No release tag on $SHA, nothing to publish." |
| 78 | + exit 0 |
48 | 79 | fi |
49 | 80 | fi |
50 | 81 |
|
| 82 | + if ! git merge-base --is-ancestor "$SHA" origin/master; then |
| 83 | + echo "::error::$TAG points at $SHA, which is not on master" |
| 84 | + exit 1 |
| 85 | + fi |
| 86 | + |
| 87 | + VERSION=${TAG#"$TAG_PREFIX"} |
| 88 | + VERSION=${VERSION#v} |
| 89 | + COMMITTED=$(git show "$SHA:$VERSION_FILE" | sed -n 's/^__version__ = "\([^"]*\)".*/\1/p') |
| 90 | + if [ "$COMMITTED" != "$VERSION" ]; then |
| 91 | + echo "::error::$TAG is version $VERSION, but $VERSION_FILE at $SHA says '$COMMITTED'" |
| 92 | + exit 1 |
| 93 | + fi |
| 94 | + |
| 95 | + echo "Will publish $TAG ($SHA)" |
| 96 | + echo "tag=$TAG" >> "$GITHUB_OUTPUT" |
| 97 | + echo "sha=$SHA" >> "$GITHUB_OUTPUT" |
| 98 | + {%- endraw %} |
| 99 | + |
| 100 | + # Release Please and CI start from the same push, and Release Please is |
| 101 | + # done minutes earlier: without this wait a release is uploaded before CI |
| 102 | + # has said anything about the commit being released. A version on PyPI |
| 103 | + # cannot be replaced. If CI failed, fix or re-run it, then re-run this. |
| 104 | + - name: Wait for CI on the released commit |
| 105 | + if: steps.release.outputs.tag != '' |
| 106 | + env: |
| 107 | + GH_TOKEN: ${% raw %}{{ github.token }}{% endraw %} |
| 108 | + SHA: ${% raw %}{{ steps.release.outputs.sha }}{% endraw %} |
| 109 | + run: {% raw %}| |
| 110 | + runs="repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$SHA&event=push&branch=master" |
| 111 | + RUN= |
| 112 | + for _ in 1 2 3 4 5 6; do |
| 113 | + RUN=$(gh api "$runs" --jq '.workflow_runs[0].id // empty' || true) |
| 114 | + [ -n "$RUN" ] && break |
| 115 | + sleep 20 |
| 116 | + done |
| 117 | + if [ -z "$RUN" ]; then |
| 118 | + echo "::error::No CI run for $SHA on master" |
| 119 | + exit 1 |
| 120 | + fi |
| 121 | + echo "Waiting for $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$RUN" |
| 122 | + until [ "$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$RUN" --jq .status)" = completed ]; do |
| 123 | + sleep 20 |
| 124 | + done |
| 125 | + CONCLUSION=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$RUN" --jq .conclusion) |
| 126 | + if [ "$CONCLUSION" != success ]; then |
| 127 | + echo "::error::CI on $SHA ended '$CONCLUSION'" |
| 128 | + exit 1 |
| 129 | + fi |
| 130 | + echo "CI passed on $SHA" |
| 131 | + {%- endraw %} |
| 132 | + |
51 | 133 | publish: |
52 | 134 | name: Build and publish to PyPI |
53 | 135 | needs: check |
54 | 136 | if: needs.check.outputs.tag != '' |
55 | 137 | runs-on: ubuntu-latest |
56 | 138 | environment: pypi |
| 139 | + permissions: |
| 140 | + contents: read |
| 141 | + id-token: write # Trusted Publisher (PyPI OIDC) |
57 | 142 | steps: |
| 143 | + # The commit check resolved, not the tag: a tag moved since then changes nothing. |
58 | 144 | - uses: actions/checkout@v7 |
59 | 145 | with: |
60 | | - ref: ${% raw %}{{ needs.check.outputs.tag }}{% endraw %} |
| 146 | + ref: ${% raw %}{{ needs.check.outputs.sha }}{% endraw %} |
61 | 147 |
|
62 | 148 | - uses: astral-sh/setup-uv@v7 |
63 | 149 |
|
64 | | - - name: Set version from release tag |
65 | | - run: | |
66 | | - VERSION="${% raw %}{{ needs.check.outputs.tag }}{% endraw %}" |
67 | | - VERSION="${VERSION#{{ project_slug }}-}" |
68 | | - VERSION="${VERSION#v}" |
69 | | - echo "__version__ = \"$VERSION\" # x-release-please-version" > {{ package_name }}/__version__.py |
70 | | - |
71 | 150 | - run: uv build |
72 | 151 | # --check-url: a run repeated after a failure skips what is already on the |
73 | 152 | # index instead of failing on it. |
|
0 commit comments