stage-publish-pythonorg.yml

parameters:
  BuildToPublish: current
  DoEmbed: true
  IncludeGPG: false
  HashAlgorithms: ['SHA256', 'MD5']

jobs:
- job: Publish_Python
  displayName: Publish python.org packages
  condition: and(succeeded(), ne(variables['SkipPythonOrgPublish'], 'true'))

  pool:
    vmImage: windows-2022

  variables:
  - group: PythonOrgPublish

  workspace:
    clean: all

  steps:
  - task: UsePythonVersion@0
    displayName: 'Use Python 3.10 or later'
    inputs:
      versionSpec: '>=3.10'

  - task: DownloadPipelineArtifact@2
    displayName: 'Download artifact: msi'
    inputs:
      ${{ if eq(parameters.BuildToPublish, 'current') }}:
        buildType: current
      ${{ else }}:
        buildType: specific
        buildVersionToDownload: specific
        project: $(resources.pipeline.build_to_publish.projectId)
        pipeline: $(resources.pipeline.build_to_publish.pipelineId)
        runId: $(resources.pipeline.build_to_publish.runID)
      artifact: msi
      targetPath: $(Pipeline.Workspace)\msi

  - ${{ if eq(parameters.DoEmbed, 'true') }}:
    - task: DownloadBuildArtifacts@1
      displayName: 'Download artifact: embed'
      inputs:
        ${{ if eq(parameters.BuildToPublish, 'current') }}:
          buildType: current
        ${{ else }}:
          buildType: specific
          buildVersionToDownload: specific
          project: $(resources.pipeline.build_to_publish.projectId)
          pipeline: $(resources.pipeline.build_to_publish.pipelineId)
          buildId: $(resources.pipeline.build_to_publish.runID)
        artifactName: embed
        # Artifact name is added to path for DownloadBuildArtifacts
        downloadPath: $(Pipeline.Workspace)

  - task: DownloadBuildArtifacts@1
    displayName: 'Download artifact: sbom'
    inputs:
      ${{ if eq(parameters.BuildToPublish, 'current') }}:
        buildType: current
      ${{ else }}:
        buildType: specific
        buildVersionToDownload: specific
        project: $(resources.pipeline.build_to_publish.projectId)
        pipeline: $(resources.pipeline.build_to_publish.pipelineId)
        buildId: $(resources.pipeline.build_to_publish.runID)
      artifactName: sbom
      # Artifact name is added to path for DownloadBuildArtifacts
      downloadPath: $(Pipeline.Workspace)


  - ${{ if eq(parameters.DoEmbed, 'true') }}:
    # Note that ARM64 MSIs are skipped at build when this option is specified
    - powershell: 'gci *embed-arm*.zip | %{ Write-Host "Not publishing: $($_.Name)"; gi $_ } | del'
      displayName: 'Prevent publishing ARM64 packages'
      workingDirectory: '$(Pipeline.Workspace)\embed'
      condition: and(succeeded(), ne(variables['PublishARM64'], 'true'))


  - ${{ if eq(parameters.IncludeGPG, 'true') }}:
    - task: DownloadSecureFile@1
      name: gpgkey
      inputs:
        secureFile: 'python-signing.key'
      displayName: 'Download GPG key'

    - powershell: |
        git clone https://github.com/python/cpython-bin-deps --branch gpg --single-branch --depth 1 --progress -v "gpg"
        gpg/gpg2.exe --import "$(gpgkey.secureFilePath)"
        $files = gci -File "msi\*\*", "embed\*.zip" -EA SilentlyContinue
        $files.FullName | %{
            gpg/gpg2.exe -ba --batch --passphrase $(GPGPassphrase) $_
            "Made signature for $_"
        }
      displayName: 'Generate GPG signatures'
      workingDirectory: $(Pipeline.Workspace)

    - powershell: |
        $p = gps "gpg-agent" -EA 0
        if ($p) { $p.Kill() }
      displayName: 'Kill GPG agent'
      condition: true


  - task: DownloadSecureFile@1
    name: sshkey
    inputs:
      secureFile: pydotorg-ssh.ppk
    displayName: 'Download PuTTY key'

  - powershell: |
      git clone https://github.com/python/cpython-bin-deps --branch putty --single-branch --depth 1 --progress -v "putty"
      "##vso[task.prependpath]$(gi putty)"
    workingDirectory: $(Pipeline.Workspace)
    displayName: 'Download PuTTY binaries'

  - powershell: >
      $(Build.SourcesDirectory)\windows-release\uploadrelease.ps1
      -build msi
      -user $(PyDotOrgUsername)
      -server $(PyDotOrgServer)
      -hostkey $(PyDotOrgHostKey)
      -keyfile "$(sshkey.secureFilePath)"
      -embed embed
      -sbom sbom
    workingDirectory: $(Pipeline.Workspace)
    condition: and(succeeded(), eq(variables['IsRealSigned'], 'true'))
    displayName: 'Upload files to python.org'

  - powershell: >
      python
      "$(Build.SourcesDirectory)\windows-release\purge.py"
      (gci msi\*\python-*.exe | %{ $_.Name -replace 'python-(.+?)(-|\.exe).+', '$1' } | select -First 1)
    workingDirectory: $(Pipeline.Workspace)
    condition: and(succeeded(), eq(variables['IsRealSigned'], 'true'))
    displayName: 'Purge CDN'

  - powershell: |
      $failures = 0
      gci "msi\*\*.exe" -File | %{
          $d = mkdir "tests\$($_.BaseName)" -Force
          gci $d -r -File | del
          $ic = copy $_ $d -PassThru
          "Checking layout for $($ic.Name)"
          Start-Process -wait $ic "/passive", "/layout", "$d\layout", "/log", "$d\log\install.log"
          if (-not $?) {
              Write-Error "Failed to validate layout of $($inst.Name)"
              $failures += 1
          }
      }
      if ($failures) {
        Write-Error "Failed to validate $failures installers"
        exit 1
      }
    workingDirectory: $(Pipeline.Workspace)
    condition: and(succeeded(), eq(variables['IsRealSigned'], 'true'))
    displayName: 'Test layouts'

  - ${{ each alg in parameters.HashAlgorithms }}:
    - powershell: |
        $files = gci -File "msi\*\*.exe", "embed\*.zip" -EA SilentlyContinue
        $hashes = $files  | `
            Sort-Object Name | `
            Format-Table Name, @{
              Label="${{ alg }}";
              Expression={(Get-FileHash $_ -Algorithm ${{ alg }}).Hash}
            }, Length -AutoSize | `
            Out-String -Width 4096
        $d = mkdir "$(Build.ArtifactStagingDirectory)\hashes" -Force
        $hashes | Out-File "$d\hashes.txt" -Encoding ascii -Append
        $hashes
      workingDirectory: $(Pipeline.Workspace)
      displayName: 'Generate hashes (${{ alg }})'

  - ${{ if eq(parameters.IncludeGPG, 'true') }}:
    - powershell: |
        "Copying:"
        $files = gci -File "msi\*\python*.asc", "embed\*.asc" -EA SilentlyContinue
        $files.FullName
        $d = mkdir "$(Build.ArtifactStagingDirectory)\hashes" -Force
        move $files $d -Force
        gci msi -Directory | %{ move "msi\$_\*.asc" (mkdir "$d\$_" -Force) }
      workingDirectory: $(Pipeline.Workspace)
      displayName: 'Copy GPG signatures for build'

  - publish: '$(Build.ArtifactStagingDirectory)\hashes'
    artifact: hashes
    displayName: 'Publish Artifact: hashes'