python-release.yml

name: Release

on:
  push:
    branches: ["main", "master"]
    paths:
      - "CHANGELOG.md"
  # Retry a release whose publish failed; the existing-release check below
  # still prevents publishing the same version twice.
  workflow_dispatch:

permissions: {}

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write # create the GitHub release and attach assets
    outputs:
      version: ${{ steps.release.outputs.version }}
      released: ${{ steps.published.outputs.released }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.13"

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          enable-cache: false

      - name: Read release version
        id: release
        run: |
          version=$(python - <<'PY'
          import tomllib
          from pathlib import Path

          pyproject = tomllib.loads(Path("pyproject.toml").read_text())
          print(pyproject["project"]["version"])
          PY
          )
          notes=".changes/${version}.md"
          if [ ! -f "$notes" ]; then
            echo "Missing release notes: $notes" >&2
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "notes=$notes" >> "$GITHUB_OUTPUT"

      - name: Check version changed
        id: version-changed
        env:
          BEFORE_SHA: ${{ github.event.before }}
          EVENT_NAME: ${{ github.event_name }}
          VERSION: ${{ steps.release.outputs.version }}
        run: |
          # Manual runs have no "before" commit; rely on the existing-release check.
          if [ "${EVENT_NAME}" = "workflow_dispatch" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          previous_version=$(git show "${BEFORE_SHA}:pyproject.toml" | python -c '
          import sys
          import tomllib

          print(tomllib.loads(sys.stdin.read())["project"]["version"])
          '
          )
          if [ "$previous_version" = "${VERSION}" ]; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Check for existing release
        id: existing-release
        if: steps.version-changed.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.release.outputs.version }}
        run: |
          if gh release view "${VERSION}" >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Build package
        if: steps.version-changed.outputs.changed == 'true' && steps.existing-release.outputs.exists == 'false'
        run: uv build

      # Package plus locked runtime dependencies only, so the SBOM matches what
      # users install from PyPI rather than the dev/test toolchain.
      - name: Install runtime environment
        if: steps.version-changed.outputs.changed == 'true' && steps.existing-release.outputs.exists == 'false'
        run: uv sync --frozen --no-default-groups --no-editable

      - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
        if: steps.version-changed.outputs.changed == 'true' && steps.existing-release.outputs.exists == 'false'
        id: syft

      # Scan site-packages only; .venv/bin links to the interpreter outside the env.
      # SPDX for the release page, CycloneDX 1.6 for DependencyTrack.
      - name: Generate SBOM
        if: steps.version-changed.outputs.changed == 'true' && steps.existing-release.outputs.exists == 'false'
        env:
          SYFT: ${{ steps.syft.outputs.cmd }}
          SYFT_FILE_METADATA_SELECTION: none
          VERSION: ${{ steps.release.outputs.version }}
        run: |
          set -euo pipefail
          "$SYFT" dir:.venv/lib \
            --source-name django-postcode-lookup \
            --source-version "${VERSION}" \
            -o spdx-json=django-postcode-lookup.spdx.json \
            -o cyclonedx-json@1.6=django-postcode-lookup.raw.cdx.json
          # The package's own entry points at the local checkout (file://); drop it.
          jq '.components |= map(if .externalReferences then .externalReferences |= map(select(.url | startswith("file://") | not)) else . end)' \
            django-postcode-lookup.raw.cdx.json > django-postcode-lookup.cdx.json

      - name: Publish package
        if: steps.version-changed.outputs.changed == 'true' && steps.existing-release.outputs.exists == 'false'
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          user: __token__
          password: ${{ secrets.pypi_password }}

      - name: Create GitHub release
        if: steps.version-changed.outputs.changed == 'true' && steps.existing-release.outputs.exists == 'false'
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.release.outputs.version }}
          NOTES: ${{ steps.release.outputs.notes }}
        run: |
          gh release create "${VERSION}" \
            --title "${VERSION}" \
            --notes-file "${NOTES}" \
            dist/* django-postcode-lookup.spdx.json django-postcode-lookup.cdx.json

      - name: Mark release published
        id: published
        if: steps.version-changed.outputs.changed == 'true' && steps.existing-release.outputs.exists == 'false'
        run: echo "released=true" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: steps.published.outputs.released == 'true'
        with:
          name: sbom-cyclonedx
          path: django-postcode-lookup.cdx.json
          retention-days: 7

  # Separate job so the DT key is never present while repo code runs
  # (uv build / uv sync above execute the build backend). Releases are created
  # with GITHUB_TOKEN, which doesn't trigger release workflows, so this lives here.
  dependencytrack:
    needs: release
    if: needs.release.outputs.released == 'true'
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: sbom-cyclonedx

      # Each release becomes a version under the "oss/python/django-postcode-lookup"
      # library container (OSS > OSS Python), which rolls up the latest version.
      - name: Upload SBOM to DependencyTrack
        env:
          DT_API_KEY: ${{ secrets.DEPENDENCYTRACK_OSS_APIKEY }}
          DT_URL: https://dependencytrack-api.labdigital.nl:8443
          PROJECT: oss/python/django-postcode-lookup
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          set -euo pipefail
          if [ -z "${DT_API_KEY}" ]; then
            echo "::error::DEPENDENCYTRACK_OSS_APIKEY is not available to this repo"
            exit 1
          fi
          curl -sS --fail-with-body -X POST "${DT_URL}/api/v1/bom" \
            -H "X-Api-Key: ${DT_API_KEY}" \
            -F "autoCreate=true" \
            -F "projectName=${PROJECT}" \
            -F "projectVersion=${VERSION}" \
            -F "parentName=${PROJECT}" \
            -F "isLatest=true" \
            -F "bom=@django-postcode-lookup.cdx.json"