chore: promote dev to main (GCP Cloud Run hardening, Windows compat, Grafana Secret Manager) #66
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test and Release Pipeline | |
| on: | |
| push: | |
| branches: [ main ] | |
| paths-ignore: | |
| - 'docs/**' | |
| - '*.md' | |
| pull_request: | |
| branches: [ main ] | |
| paths-ignore: | |
| - 'docs/**' | |
| - '*.md' | |
| workflow_dispatch: | |
| jobs: | |
| test-build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install Poetry | |
| uses: snok/install-poetry@v1 | |
| with: | |
| version: latest | |
| virtualenvs-create: true | |
| virtualenvs-in-project: true | |
| - name: Cache Poetry dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: .venv | |
| key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }} | |
| restore-keys: ${{ runner.os }}-poetry- | |
| - name: Install dependencies | |
| run: poetry install --only=main | |
| - name: Install twine | |
| run: poetry run pip install twine | |
| - name: Set dynamic version | |
| run: | | |
| VERSION="0.0.${{ github.run_number }}" | |
| poetry version $VERSION | |
| echo "VERSION=$VERSION" >> $GITHUB_ENV | |
| - name: Build package | |
| run: poetry build | |
| - name: Check package with twine | |
| run: poetry run twine check dist/* | |
| - name: Upload to Test PyPI | |
| if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main') | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| repository-url: https://test.pypi.org/legacy/ | |
| username: __token__ | |
| password: ${{ secrets.TEST_PYPI_API_TOKEN }} | |
| skip-existing: true | |
| production-release: | |
| needs: test-build | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: write | |
| pull-requests: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install Poetry | |
| uses: snok/install-poetry@v1 | |
| with: | |
| version: latest | |
| virtualenvs-create: true | |
| virtualenvs-in-project: true | |
| - name: Cache Poetry dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: .venv | |
| key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }} | |
| restore-keys: ${{ runner.os }}-poetry- | |
| - name: Install dependencies | |
| run: poetry install --only=main | |
| - name: Install twine | |
| run: poetry run pip install twine | |
| - name: Set patch version for production | |
| run: | | |
| # Use run number for unique patch versions | |
| VERSION="0.0.${{ github.run_number }}" | |
| echo "VERSION=$VERSION" >> $GITHUB_ENV | |
| poetry version $VERSION | |
| # Create git tag for the release | |
| git config --local user.email "action@github.com" | |
| git config --local user.name "GitHub Action" | |
| git tag "v$VERSION" | |
| - name: Build package | |
| run: poetry build | |
| - name: Check package with twine | |
| run: poetry run twine check dist/* | |
| - name: Publish to PyPI | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| username: __token__ | |
| password: ${{ secrets.PYPI_API_TOKEN }} | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: "v${{ env.VERSION }}" | |
| files: dist/* | |
| generate_release_notes: true | |
| make_latest: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |