libmongocrypt/.github/workflows/release-python.yml at master · mongodb/libmongocrypt · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
name: Python Release

on:
  workflow_dispatch:
    inputs:
      following_version:
        description: "The post (dev) version to set"
      dry_run:
        description: "Dry Run?"
        default: false
        type: boolean
  schedule:
    - cron:  '30 5 * * *'

env:
  # Changes per repo
  PRODUCT_NAME: PyMongoCrypt
  EVERGREEN_PROJECT: libmongocrypt
  # Constant
  # inputs will be empty on a scheduled run.  so, we only set dry_run
  # to 'false' when the input is set to 'false'.
  DRY_RUN: ${{ ! contains(inputs.dry_run, 'false') }}
  FOLLOWING_VERSION: ${{ inputs.following_version || '' }}

defaults:
  run:
    shell: bash -eux {0}

jobs:
  pre-publish:
    environment: release-python
    if: github.repository_owner == 'mongodb' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    outputs:
      version: ${{ steps.pre-publish.outputs.version }}
    steps:
      - uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
        with:
          app_id: ${{ vars.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}
      - uses: mongodb-labs/drivers-github-tools/setup@v3
        with:
          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
          aws_region_name: ${{ vars.AWS_REGION_NAME }}
          aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
      - uses: mongodb-labs/drivers-github-tools/python/pre-publish@v3
        id: pre-publish
        with:
          working_directory: ./bindings/python
          dry_run: ${{ env.DRY_RUN }}
          tag_template: "pymongocrypt-${VERSION}"
          tag_message_template:  "Release PyMongoCrypt ${VERSION}"

  build-dist:
    needs: [pre-publish]
    uses: ./.github/workflows/dist-python.yml
    with:
      ref: ${{ needs.pre-publish.outputs.version }}

  static-python:
    needs: [pre-publish]
    uses: ./.github/workflows/codeql-python.yml
    with:
      ref: ${{ needs.pre-publish.outputs.version }}

  static-actions:
    needs: [pre-publish]
    uses: ./.github/workflows/codeql-actions.yml
    with:
      ref: ${{ needs.pre-publish.outputs.version }}

  publish:
    needs: [build-dist, static-python, static-actions]
    name: Upload release to PyPI
    runs-on: ubuntu-latest
    environment: release-python
    permissions:
      id-token: write
    steps:
      - name: Download all the dists
        uses: actions/download-artifact@v6
        with:
          name: all-dist-${{ github.run_id }}
          path: dist/
      - name: Publish package distributions to TestPyPI
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
        with:
          repository-url: https://test.pypi.org/legacy/
          skip-existing: true
          attestations: ${{ env.DRY_RUN }}
      - name: Publish package distributions to PyPI
        if: startsWith(env.DRY_RUN, 'false')
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1

  post-publish:
    needs: [publish]
    runs-on: ubuntu-latest
    environment: release-python
    permissions:
      id-token: write
      contents: write
      attestations: write
      security-events: write
    steps:
      - uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
        with:
          app_id: ${{ vars.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}
      - uses: mongodb-labs/drivers-github-tools/setup@v3
        with:
          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
          aws_region_name: ${{ vars.AWS_REGION_NAME }}
          aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
      - uses: mongodb-labs/drivers-github-tools/python/post-publish@v3
        with:
          following_version: ${{ env.FOLLOWING_VERSION }}
          working_directory: ./bindings/python
          product_name: ${{ env.PRODUCT_NAME }}
          sbom_in_path: bindings/python/sbom.json
          kondukto_sub_project: pymongocrypt
          evergreen_project: ${{ env.EVERGREEN_PROJECT }}
          tag_template: "pymongocrypt-${VERSION}"
          token: ${{ github.token }}
          dry_run: ${{ env.DRY_RUN }}