devqubit/.github/workflows/release.yaml at main · devqubit-labs/devqubit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
name: Release

on:
  push:
    tags:
      - "v*"

jobs:
  build:
    name: Build + test + package (all)
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install uv (Python 3.12)
        uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
          enable-cache: true

      - name: Sync (workspace + dev + all extras)
        run: uv sync --all-packages --all-extras --dev --locked

      - name: Run tests
        run: uv run pytest

      - name: Install build backend
        run: uv pip install --upgrade build

      - name: Verify tag matches all package versions
        run: |
          uv run python - << 'PY'
          import os, sys, pathlib, tomllib

          tag = os.environ["GITHUB_REF_NAME"]  # v0.1.0
          ver = tag[1:] if tag.startswith("v") else tag

          pyprojects = [pathlib.Path("pyproject.toml")]
          pyprojects += sorted(pathlib.Path("packages").glob("*/pyproject.toml"))

          mismatches = []
          for p in pyprojects:
            data = tomllib.loads(p.read_text(encoding="utf-8"))
            v = data.get("project", {}).get("version")
            if v != ver:
              mismatches.append((str(p), v))

          if mismatches:
            for p, v in mismatches:
              print(f"Version mismatch: {p}: {v!r} != {ver!r}")
            sys.exit(1)

          print("OK: all versions match", ver)
          PY

      - name: Build root dist (devqubit)
        run: uv run python -m build --outdir dist .

      - name: Build workspace member dists
        run: |
          set -euo pipefail
          for pkg in packages/*; do
            if [ -f "$pkg/pyproject.toml" ]; then
              echo "Building $pkg"
              uv run python -m build --outdir dist "$pkg"
            fi
          done

      - name: Upload dists artifact
        uses: actions/upload-artifact@v7
        with:
          name: python-package-distributions
          path: dist/

  publish:
    name: Publish to PyPI
    needs: [build]
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      contents: read

    environment:
      name: pypi
      url: https://pypi.org/

    env:
      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}

    steps:
      - name: Download dists
        uses: actions/download-artifact@v8
        with:
          name: python-package-distributions
          path: dist/

      # 1) Bootstrap (when PYPI_TOKEN is set)
      - name: Publish (bootstrap via PyPI token)
        if: ${{ env.PYPI_TOKEN != '' }}
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ env.PYPI_TOKEN }}
          packages-dir: dist/
          skip-existing: true
          verbose: true

      # 2) Trusted Publishing OIDC (when PYPI_TOKEN is not set)
      - name: Publish (Trusted Publishing / OIDC)
        if: ${{ env.PYPI_TOKEN == '' }}
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/
          skip-existing: true
          verbose: true