release-python-sdk.yml

name: Release Python SDK

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g., 1.2.3 or v1.2.3)'
        required: true
        type: string

permissions:
  contents: write
  id-token: write

env:
  RELEASE_VERSION: ${{ github.event.inputs.version || github.ref_name }}

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          enable-cache: true

      - name: Install dev dependencies with uv
        working-directory: python-sdk
        run: |
          uv sync --group dev

      - name: Install python-sdk package (editable)
        working-directory: python-sdk
        run: |
          uv pip install -e .

      - name: Run tests with pytest and coverage
        working-directory: python-sdk
        run: |
          uv run pytest --cov=exospherehost --cov-report=xml --cov-report=term-missing -v --junitxml=pytest-report.xml

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: exospherehost/exospherehost
          files: python-sdk/coverage.xml
          flags: python-sdk-unittests
          name: python-sdk-coverage-report
          fail_ci_if_error: true

      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: python-sdk-test-results
          path: python-sdk/pytest-report.xml
          retention-days: 1

  publish:
    runs-on: ubuntu-latest
    needs: test
    defaults:
      run:
        working-directory: python-sdk
    if: github.repository == 'exospherehost/exospherehost'

    steps:
      - uses: actions/checkout@v4

      - uses: astral-sh/setup-uv@v6
        name: Install uv
        with:
          enable-cache: true

      - run: uv python install
     
      - run: uv sync --locked --dev

      - name: Update version to release tag
        run: |
          # Extract version from input or tag (remove 'v' or 'V' prefix if present)
          RELEASE_VERSION="${{ env.RELEASE_VERSION }}"
          
          # Handle empty or invalid tags
          if [[ -z "$RELEASE_VERSION" ]]; then
            echo "ERROR: Release tag is empty"
            exit 1
          fi
          
          # Remove 'v' or 'V' prefix (case insensitive)
          if [[ $RELEASE_VERSION =~ ^[vV] ]]; then
            RELEASE_VERSION="${RELEASE_VERSION#?}"  # Remove first character
          fi
          
          # Validate the extracted version is not empty
          if [[ -z "$RELEASE_VERSION" ]]; then
            echo "ERROR: Invalid tag format - version part is empty"
            exit 1
          fi
          
          # Update the version file
          echo "version = \"$RELEASE_VERSION\"" > exospherehost/_version.py
          
          echo "Updated version to $RELEASE_VERSION for release"

      - name: Verify version format
        run: |
          uv run python -c "
          import sys
          sys.path.append('.')
          from exospherehost._version import version
          import re
          
          # Check if version matches semantic versioning pattern
          if not re.match(r'^\d+\.\d+\.\d+$', version):
              print(f'ERROR: Version {version} does not match semantic versioning pattern (x.y.z)')
              sys.exit(1)
          
          # Ensure it's not a beta version (should not contain 'b')
          if 'b' in version:
              print(f'ERROR: Release version {version} contains beta indicator. Release versions should not be beta.')
              sys.exit(1)
          
          print(f'Version {version} is valid for release publishing')
          "

      - name: Generate requirements file for SBOM
        run: |
          # Try to use uv to export only production dependencies without the current package
          # Use --no-dev to exclude dev dependencies and generate a clean requirements file
          uv export --locked --no-dev --format=requirements-txt --output-file=requirements-full.txt
          # Debug: Show what's in the requirements file
          echo "Contents of requirements-full.txt:"
          cat requirements-full.txt
          # Filter out any editable local package references
          # This handles: -e ., -e ./, -e ../, -e file://..., file://... etc.
          grep -v -E '^-e\s+\.$|^-e\s+\.\/$|^-e\s+\.\.\/$|^-e\s+file:|^file:' requirements-full.txt > requirements.txt || echo "# No dependencies after filtering" > requirements.txt
          echo "Contents of filtered requirements.txt:"
          cat requirements.txt
          echo "Generated requirements.txt for SBOM creation from lockfile (excluding editable local package)"

      - name: Install SBOM generation tools
        run: |
          uv tool install cyclonedx-bom
          echo "Installed cyclonedx-bom version:"
          uv tool run --from cyclonedx-bom cyclonedx-py --version
          uv tool install pip-audit
          echo "Installed pip-audit version:"
          uv tool run pip-audit --version

      - name: Generate SBOM with CycloneDX
        run: |
          uv tool run --from cyclonedx-bom cyclonedx-py requirements --of json --output-file sbom-cyclonedx.json requirements.txt
          uv tool run --from cyclonedx-bom cyclonedx-py requirements --of xml --output-file sbom-cyclonedx.xml requirements.txt
          echo "Generated CycloneDX SBOM in JSON and XML formats"

      - name: Generate vulnerability report with pip-audit
        run: |
          uv tool run pip-audit --format json --output vulnerability-report.json --requirement requirements.txt || true
          echo "Generated vulnerability report (non-blocking)"

      - name: Create SBOM summary
        run: |
          echo "## Software Bill of Materials (SBOM)" > sbom-summary.md
          echo "" >> sbom-summary.md
          echo "This release includes the following supply chain security artifacts:" >> sbom-summary.md
          echo "" >> sbom-summary.md
          echo "- **Provenance**: Cryptographic proof of build integrity using GitHub's OIDC tokens" >> sbom-summary.md
          echo "- **SBOM**: Complete dependency inventory in CycloneDX format" >> sbom-summary.md
          echo "- **Vulnerability Report**: Security scan results for all dependencies" >> sbom-summary.md
          echo "" >> sbom-summary.md
          echo "### Dependencies Count:" >> sbom-summary.md
          echo "- Direct dependencies: $(grep -c '^[^#]' requirements.txt || echo '0')" >> sbom-summary.md
          echo "- Total dependencies (including transitive): $(wc -l < requirements.txt)" >> sbom-summary.md
          echo "" >> sbom-summary.md
          echo "### Verification:" >> sbom-summary.md
          echo "You can verify this package's provenance on PyPI using:" >> sbom-summary.md
          echo '```bash' >> sbom-summary.md
          echo 'pip install sigstore' >> sbom-summary.md
          echo 'python -m sigstore verify --bundle <bundle-file> exospherehost==${{ env.RELEASE_VERSION }}' >> sbom-summary.md
          echo '```' >> sbom-summary.md

      - run: uv build
   
      - name: Sign the package
        run: |
          python -m pip install -U pypi-attestations
          python -m pypi_attestations sign dist/*

      - name: Publish to PyPI with provenance
        run: |
          python -m pip install -U twine
          # Try to upload, but don't fail if the version already exists
          python -m twine upload --attestations dist/* 

      - name: Upload SBOM artifacts
        uses: actions/upload-artifact@v4
        with:
          name: sbom-artifacts-${{ env.RELEASE_VERSION }}
          path: |
            python-sdk/sbom-cyclonedx.json
            python-sdk/sbom-cyclonedx.xml
            python-sdk/requirements.txt
            python-sdk/vulnerability-report.json
            python-sdk/sbom-summary.md
          retention-days: 1

      - name: Add SBOM to release assets
        uses: softprops/action-gh-release@v2
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            python-sdk/sbom-cyclonedx.json
            python-sdk/sbom-cyclonedx.xml
            python-sdk/sbom-summary.md
            python-sdk/vulnerability-report.json
          body_path: python-sdk/sbom-summary.md
          append_body: true