openjd-model-for-python/.github/workflows/release_publish.yml at mainline · OpenJobDescription/openjd-model-for-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: "Release: Publish"
run-name: "Release: ${{ github.event.head_commit.message || inputs.tag }}"

on:
  push:
    branches:
      - mainline
    paths:
      - CHANGELOG.md
  workflow_dispatch:
    inputs:
      tag:
        required: true
        type: string
        description: Specify a tag to re-run a release.

concurrency:
  group: release

permissions:
  contents: read

jobs:
  TagRelease:
    uses: OpenJobDescription/.github/.github/workflows/reusable_tag_release.yml@mainline
    secrets: inherit
    with:
      tag: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || '' }}

  UnitTests:
    name: Unit Tests
    needs: TagRelease
    uses: ./.github/workflows/code_quality.yml
    with:
      tag: ${{ needs.TagRelease.outputs.tag }}

  PreRelease:
      needs: [TagRelease, UnitTests]
      uses: OpenJobDescription/.github/.github/workflows/reusable_prerelease.yml@mainline
      permissions:
        id-token: write
        contents: write
      secrets: inherit
      with:
          tag: ${{ needs.TagRelease.outputs.tag }}

  Release:
      needs: [TagRelease, PreRelease]
      uses: OpenJobDescription/.github/.github/workflows/reusable_release.yml@mainline
      secrets: inherit
      permissions:
        id-token: write
        contents: write
      with:
          tag: ${{ needs.TagRelease.outputs.tag }}

  Publish:
    needs: [TagRelease, Release]
    uses: OpenJobDescription/.github/.github/workflows/reusable_publish_python.yml@mainline
    permissions:
      id-token: write
    secrets: inherit
    with:
        tag: ${{ needs.TagRelease.outputs.tag }}

  # PyPI does not support reusable workflows yet
  # # See https://github.com/pypi/warehouse/issues/11096
  PublishToPyPI:
    needs: [TagRelease, Publish]
    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.TagRelease.outputs.tag }}
          fetch-depth: 0
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.9'
      - name: Install dependencies
        run: |
          pip install --upgrade hatch "virtualenv<21"
      - name: Build
        run: hatch -v build
      # # See https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-pypi
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1