main.yml

# This workflow will upload a Python Package using Twine when a release is created
# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: Publish Python Package and Docker Image

on:
  push:
    branches:
      - release-v*
  release:
    types: [published]

jobs:
  build_pypi_and_docker:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v5
      with:
        fetch-depth: 0 # unshallow checkout enables setuptools_scm to infer PyPi version from Git

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.12'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build setuptools

    - name: Build Package
      run: python -m build

    - name: Upload Wheel Artifact
      uses: actions/upload-artifact@v4
      with:
        name: netfoundry-wheel-${{ github.run_id }}
        path: dist/netfoundry-*.whl
        if-no-files-found: error

    - name: Install Wheel
      run: pip install dist/netfoundry-*.whl

    - name: Read version string
      id: read_version
      run: |
        PYPI_VERSION=$(python setup.py --version)
        [[ ${PYPI_VERSION} =~ ^[0-9]+\.[0-9]+\.[0-9]+.* ]] || {
          echo "ERROR: unexpected version string '${PYPI_VERSION}'" >&2
          exit 1
        }
        echo ::set-output name=pypi_version::${PYPI_VERSION}

    - name: Compare installed version to PyPi version
      env:
        PYPI_VERSION: ${{ steps.read_version.outputs.pypi_version }}
      run: |
        INSTALLED_VERSION="$(python3 -m netfoundry.version)"
        echo "PYPI_VERSION=${PYPI_VERSION}, INSTALLED_VERSION=${INSTALLED_VERSION#v}"
        if ! [[ ${PYPI_VERSION} == ${INSTALLED_VERSION#v} ]]; then
          echo "ERROR: PyPi and installed version do not match." >&2
          exit 1
        fi

    - name: Test shell autocomplete
      run: |
        register-python-argcomplete nfctl

    - name: Run the NF CLI demo to  test installed version
      id: test_demo
      shell: bash
      env:
        NETFOUNDRY_CLIENT_ID: ${{ secrets.NETFOUNDRY_CLIENT_ID }}
        NETFOUNDRY_PASSWORD: ${{ secrets.NETFOUNDRY_PASSWORD }}
        NETFOUNDRY_OAUTH_URL: ${{ secrets.NETFOUNDRY_OAUTH_URL }}
      run: ./scripts/test-demo.sh

    - name: Publish Test Package
      uses: pypa/gh-action-pypi-publish@v1.13.0
      with:
        user: __token__
        password: ${{ secrets.TEST_PYPI_API_TOKEN }}
        repository_url: https://test.pypi.org/legacy/

    - name: Append 'latest' tag if release
      env:
        GITHUB_EVENT_ACTION: ${{ github.event.action }}
        PYPI_VERSION: ${{ steps.read_version.outputs.pypi_version }}
      id: compose_tags
      run: |
        CONTAINER_TAGS="netfoundry/python:${PYPI_VERSION}"
        if [[ ${GITHUB_EVENT_ACTION} == published ]]; then
          CONTAINER_TAGS+=",netfoundry/python:latest"
        fi
        echo GITHUB_EVENT_ACTION="${GITHUB_EVENT_ACTION}"
        echo CONTAINER_TAGS="${CONTAINER_TAGS}"
        echo ::set-output name=container_tags::${CONTAINER_TAGS}

    - name: Publish Release to PyPi
      if: github.event.action == 'published'
      uses: pypa/gh-action-pypi-publish@v1.13.0
      with:
        user: __token__
        password: ${{ secrets.PYPI_API_TOKEN }}

    - name: Attach Wheel Artifact to GH Release
      if: ${{ github.event.action == 'published' }}
      uses: softprops/action-gh-release@v2
      with:
        files: dist/netfoundry-*.whl
        fail_on_unmatched_files: true
        generate_release_notes: true

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
      with:
        platforms: amd64,arm64
        # ignore arm/v7 (32bit) because unsupported by "cryptography" dep of
        # Ansible and demand seems unlikely

    - name: Set up Docker BuildKit
      id: buildx
      uses: docker/setup-buildx-action@v3

    - name: Login to Docker Hub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKER_HUB_API_USER }}
        password: ${{ secrets.DOCKER_HUB_API_TOKEN }}

    - name: Build & Push Multi-Platform Container
      uses: docker/build-push-action@v6
      with:
        context: ${{ github.workspace }} # build context is workspace so we can copy artifacts from ./dist/
        file: ${{ github.workspace }}/docker/Dockerfile
        builder: ${{ steps.buildx.outputs.name }}
        platforms: linux/amd64,linux/arm64
        push: true
        tags: ${{ steps.compose_tags.outputs.container_tags }}

  cleanup-delay:
    if: failure()
    needs: [build_pypi_and_docker]
    runs-on: ubuntu-latest
    steps:
      - name: Wait 30 minutes before cleanup
        run: |
          echo "Test demo failed to complete. Waiting 30 minutes before cleanup to allow investigation..."
          sleep 1800

  cleanup-network:
    if: always() && needs.build_pypi_and_docker.result == 'failure'
    needs: [cleanup-delay]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - name: Install nfctl
        run: |
          python -m pip install --upgrade pip
          pip install .

      - name: Delete test network
        env:
          NETFOUNDRY_CLIENT_ID: ${{ secrets.NETFOUNDRY_CLIENT_ID }}
          NETFOUNDRY_PASSWORD: ${{ secrets.NETFOUNDRY_PASSWORD }}
          NETFOUNDRY_OAUTH_URL: ${{ secrets.NETFOUNDRY_OAUTH_URL }}
        run: |
          # Use wildcard pattern to match network created by this run
          NETWORK_PATTERN="gh-${GITHUB_RUN_ID}-%"
          echo "Attempting to delete network matching: ${NETWORK_PATTERN}"

          # Try to delete the network, ignore errors if it doesn't exist
          nfctl delete network "name=${NETWORK_PATTERN}" --yes || echo "Network may not exist or already deleted"