developer-toolkit-elasticache/.github/workflows/python-release.yml at main · aws/developer-toolkit-elasticache · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: Publish Python package to PyPI

# Trusted publisher on PyPI must reference this exact filename and the `pypi`
# environment, or publishing is rejected.

on:
  release:
    types: [published]

permissions:
  contents: read

# cancel-in-progress: false — cancelling mid-publish can corrupt a release.
concurrency:
  group: python-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # Source of truth for the test matrix: generated from [tool.python-support].
  # python-v* tags only — test/build/publish inherit this via `needs`.
  versions:
    name: python versions
    if: startsWith(github.ref_name, 'python-v')
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      data: ${{ steps.set.outputs.data }}
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Generate supported versions from pyproject.toml
        id: set
        run: echo "data=$(python scripts/python_dev.py list-supported-versions)" >> "$GITHUB_OUTPUT"

  # Full support matrix gates the release; build/publish depend on it. Sanity check with
  # Ubuntu-only tests since package is pure-Python.
  test:
    name: test (py${{ matrix.python-version }})
    needs: versions
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false  # report every version, not just the first failure
      matrix:
        python-version: ${{ fromJson(needs.versions.outputs.data).all }}
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install and run the test suite
        timeout-minutes: 10
        run: python scripts/python_dev.py test

  build:
    name: build and verify
    needs: test
    if: startsWith(github.ref_name, 'python-v')
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      # Tag must match pyproject.toml version, and the publish guard `Private :: Do Not Upload`
      # must be gone.
      - name: Verify the tag matches the packaged version and the package is publishable
        run: python scripts/python_dev.py verify "$GITHUB_REF_NAME"

      - name: Build wheel and sdist, check metadata
        timeout-minutes: 5
        run: python scripts/python_dev.py package

      - name: Save built distributions for the publish job
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: python-dist
          path: python/dist/
          if-no-files-found: error  # an empty artifact silently breaks the publish job

  publish:
    name: publish
    needs: build
    if: startsWith(github.ref_name, 'python-v')
    runs-on: ubuntu-latest
    timeout-minutes: 10
    # Must match the environment name on the trusted publisher; carries the
    # required-reviewer gate so a run alone cannot publish.
    environment: pypi
    permissions:
      # Job permissions REPLACE the top-level block, so restate contents: read.
      contents: read
      id-token: write  # OIDC token for PyPI auth + PEP 740 attestation signing
    steps:
      # Checkout so the smoke-test script is on the runner.
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Retrieve built distributions from the build job
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: python-dist
          path: dist/

      - name: Publish to PyPI with attestations
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          attestations: true

      - name: Smoke-test the published package
        run: python scripts/python_dev.py smoke "${GITHUB_REF_NAME#python-v}"