release-upload.yml

# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

name: "CI: Upload git archive"

on:
  workflow_call:
    inputs:
      git-tag:
        type: string
        required: true
      run-id:
        description: "The GHA run ID that generated validated artifacts"
        type: string
        required: true
      component:
        description: "Component to download wheels for"
        type: string
        required: true
      dry-run:
        description: "Validate release artifacts without uploading them to the GitHub release"
        type: boolean
        required: false
        default: false

concurrency:
  # Concurrency group that uses the workflow name and PR number if available
  # or commit SHA as a fallback. If a new build is triggered under that
  # concurrency group while a previous build is running it will be canceled.
  # Repeated pushes to a PR will cancel all previous builds, while multiple
  # merges to main will not cancel.
  group: ${{ github.workflow }}-${{ github.ref_name || github.sha }}
  cancel-in-progress: true

permissions:
  contents: write

jobs:
  # create source archive and upload it to the published release
  # URL to the archive: https://github.com/NVIDIA/<repo>/releases/download/<tag>/<repo>-<tag>.tar.gz
  upload:
    if: ${{ !github.event.repository.fork }}
    runs-on: ubuntu-latest
    env:
      ARCHIVE_NAME: ${{ github.event.repository.name }}-${{ inputs.git-tag }}
    steps:
      - name: Checkout Source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 1
          ref: ${{ inputs.git-tag }}

      - name: Create Release Directory
        run: mkdir -p release

      - name: Archive Source
        run: >
          git archive
          --format=tar.gz
          --prefix="${{ env.ARCHIVE_NAME }}/"
          --output="release/${{ env.ARCHIVE_NAME }}.tar.gz"
          ${{ inputs.git-tag }}

      - name: Compute Checksum
        run: >
          sha256sum "release/${{ env.ARCHIVE_NAME }}.tar.gz"
          | awk '{print $1}'
          > "release/${{ env.ARCHIVE_NAME }}.tar.gz.sha256sum"

      - name: Upload Archive
        if: ${{ !inputs.dry-run }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: >
          gh release upload
          --clobber "${{ inputs.git-tag }}"
          --repo "${{ github.repository }}"
          release/*

      - name: Download and Validate Wheels
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Use the shared script to download wheels
          ./ci/tools/download-wheels "${{ inputs.run-id }}" "${{ inputs.component }}" "${{ github.repository }}" "release/wheels"

          # Validate that release wheels match the expected version from tag.
          ./ci/tools/validate-release-wheels "${{ inputs.git-tag }}" "${{ inputs.component }}" "release/wheels"

      - name: Upload Wheels
        if: ${{ !inputs.dry-run }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if [[ -d "release/wheels" && $(ls -A release/wheels 2>/dev/null | wc -l) -gt 0 ]]; then
            echo "Uploading wheels to release ${{ inputs.git-tag }}"
            gh release upload --clobber "${{ inputs.git-tag }}" --repo "${{ github.repository }}" release/wheels/*
          fi

      - name: Upload dry-run release artifacts
        if: ${{ inputs.dry-run }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
        with:
          name: release-artifacts-dry-run-${{ inputs.component }}-${{ inputs.git-tag }}
          path: release/
          retention-days: 3