python-build-pystandalone/.github/workflows/release.yml at main · fox-it/python-build-pystandalone · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "The version to release (e.g., '20260414')."
        type: string
      sha:
        description: "The full SHA of the commit to be released (e.g., 'd09ff921d92d6da8d8a608eaa850dc8c0f638194')."
        type: string
      dry-run:
        description: "Dry run? Tests the release process without publishing."
        default: false
        required: false
        type: boolean

env:
  FORCE_COLOR: 1

permissions: {}

jobs:
  release-gate:
    name: Release gate
    runs-on: ubuntu-latest
    environment: release
    steps:
      - run: echo "Release approved"

  release:
    name: Release
    needs: release-gate
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    runs-on: ubuntu-24.04
    environment: release

    permissions:
      contents: write
      packages: write
      # Permissions used for actions/attest-build-provenance
      id-token: write
      attestations: write

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: true # needed for git operations below

      - uses: extractions/setup-crate@4993624604c307fbca528d28a3c8b60fa5ecc859 # v1.4.0
        with:
          repo: casey/just
          version: 1.42.4

      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0

      # Perform a release in dry-run mode.
      - run: just release-dry-run ${GH_TOKEN} ${GITHUB_EVENT_INPUTS_SHA} ${GITHUB_EVENT_INPUTS_TAG}
        if: ${{ github.event.inputs.dry-run == 'true' }}
        env:
          GITHUB_EVENT_INPUTS_SHA: ${{ github.event.inputs.sha }}
          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
      - name: Configure Git identity
        if: ${{ github.event.inputs.dry-run == 'false' }}
        run: |
          git config --global user.name "$GITHUB_ACTOR"
          git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com"

      # Create a GitHub draft release for the target commit.
      - name: Create GitHub Release
        if: ${{ github.event.inputs.dry-run == 'false' }}
        run: just release-create ${GITHUB_EVENT_INPUTS_TAG} ${GITHUB_EVENT_INPUTS_SHA}
        env:
          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
          GITHUB_EVENT_INPUTS_SHA: ${{ github.event.inputs.sha }}

      # Uploading the relevant artifact to the GitHub release.
      - run: just release-run ${GH_TOKEN} ${GITHUB_EVENT_INPUTS_SHA} ${GITHUB_EVENT_INPUTS_TAG}
        if: ${{ github.event.inputs.dry-run == 'false' }}
        env:
          GITHUB_EVENT_INPUTS_SHA: ${{ github.event.inputs.sha }}
          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
      - name: Generate attestations
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        if: ${{ github.event.inputs.dry-run == 'false' }}
        with:
          subject-path: |
            dist/*.tar.gz
            dist/*.tar.zst