publish.yaml.jinja

{% raw %}name: Publish to Package Registry

on:
  workflow_dispatch:
    inputs:
      publish_to_primary:
        description: 'Publish to Primary Registry'
        type: boolean
        required: false
        default: false
env:
  PYTHONUNBUFFERED: True
  PRE_COMMIT_HOME: ${{ github.workspace }}/.precommit_cache

permissions:
  id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)

jobs:
  get-values:
    name: Get Values
    runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
    outputs:
      package-version: ${{ steps.extract-package-version.outputs.package_version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@{% endraw %}{{ gha_checkout }}{% raw %}
      - name: Setup python
        uses: actions/setup-python@{% endraw %}{{ gha_setup_python }}{% raw %}
        with:
          python-version: {% endraw %}{{ python_version }}{% raw %}
      - name: Extract package version
        id: extract-package-version
        run: |
          VERSION=$(python3 ./.github/workflows/git_tag.py)
          echo "Extracted version: $VERSION"
          echo "package_version=$VERSION" >> $GITHUB_OUTPUT

  lint:
    name: Pre-commit
    uses: ./.github/workflows/pre-commit.yaml
    permissions:
      contents: write # needed for mutex
      id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
    with:
      python-version: {% endraw %}{{ python_version }}{% raw %}

  test:
    needs: [ lint ]
    strategy:
      matrix:
        os:
          - "{% endraw %}{{ gha_linux_runner }}{% raw %}"
{% endraw %}{% if use_windows_in_ci %}          - {{ gha_windows_runner }}{% endif %}{% raw %}
        python-version:
{% endraw %}{% for item in python_ci_versions %}
          - {{ item }}
{% endfor %}{% raw %}
        include:
          - os: "{% endraw %}{{ gha_linux_runner }}{% raw %}"
            python-version: "{% endraw %}{{ python_ci_versions[0] }}{% raw %}"
            JOB_MATCHING_DEV_ENV: true

    runs-on: ${{ matrix.os }}
    env:
      UV_PYTHON: ${{ matrix.python-version }}

    steps:
      - name: Checkout code
        uses: actions/checkout@{% endraw %}{{ gha_checkout }}{% raw %}

      - name: Install python tooling
        uses: ./.github/actions/install_deps
        with:
          python-version: ${{ matrix.python-version }}{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %}
          code-artifact-auth-role-name: CoreInfraBaseAccess
          code-artifact-auth-role-account-id: {% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %}
          code-artifact-auth-region: {% endraw %}{{ aws_org_home_region }}{% endif %}{% raw %}

      - name: Unit test
        run: uv run pytest --durations=5

  build:
    needs: [ test ]
    runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}

    steps:
      - name: Checkout code
        uses: actions/checkout@{% endraw %}{{ gha_checkout }}{% raw %}

      - name: Install python tooling
        uses: ./.github/actions/install_deps
        with:
          python-version: {% endraw %}{{ python_version }}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %}
          code-artifact-auth-role-name: CoreInfraBaseAccess
          code-artifact-auth-role-account-id: {% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %}
          code-artifact-auth-region: {% endraw %}{{ aws_org_home_region }}{% endif %}{% raw %}

{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %}
      - name: OIDC Auth for Installing any dependencies that uv may need for build (sometimes it likes to install setuptools...even if it's already in the package dependencies)
        uses: aws-actions/configure-aws-credentials@{% endraw %}{{ gha_configure_aws_credentials }}{% raw %}
        with:
          role-to-assume: arn:aws:iam::{% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %}:role/CoreInfraBaseAccess
          aws-region: {% endraw %}{{ aws_org_home_region }}{% raw %}

{% endraw %}{% endif %}{% raw %}
      - name: Build package
        run: |
{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %}          . .devcontainer/code-artifact-auth.sh{% endraw %}{% endif %}{% raw %}
          uv build --no-sources

      - name: Upload build package
        uses: actions/upload-artifact@{% endraw %}{{ gha_upload_artifact }}{% raw %}
        with:
          name: python-package-distributions
          path: dist/
          if-no-files-found: error


  publish-to-staging:
    name: Publish Python distribution to Staging Package Registry
    needs: [ build ]
    runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
    environment:
      name: testpypi
      url: https://test.pypi.org/p/{% endraw %}{{ package_name | replace('_', '-') }}{% raw %}
    permissions:
      attestations: write
      id-token: write
    steps:
      - name: Download all the dists
        uses: actions/download-artifact@{% endraw %}{{ gha_download_artifact }}{% raw %}
        with:
          name: python-package-distributions
          path: dist/
{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %}
      - name: OIDC Auth for Publishing to CodeArtifact
        uses: aws-actions/configure-aws-credentials@{% endraw %}{{ gha_configure_aws_credentials }}{% raw %}
        with:
          role-to-assume: arn:aws:iam::{% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %}:role/GHA-CA-Primary-{% endraw %}{{ repo_name }}{% raw %}
          aws-region: {% endraw %}{{ aws_org_home_region }}{% raw %}

      - name: Publish distribution to Code Artifact
        run: |
          . .devcontainer/code-artifact-auth.sh
          uv publish --verbose --index code-artifact-primary --username aws --password "$TWINE_PASSWORD"

{% endraw %}{% else %}{% raw %}
      - name: Publish distribution to Test PyPI
        uses: pypa/gh-action-pypi-publish@{% endraw %}{{ gha_pypi_publish }}{% raw %}
        with:
          attestations: false
          repository-url: https://test.pypi.org/legacy/
{% endraw %}{% endif %}{% raw %}


  install-from-staging:
    name: Install package from staging registry
    needs: [ publish-to-staging, get-values ]
    strategy:
      matrix:
        os:
          - "{% endraw %}{{ gha_linux_runner }}{% raw %}"
{% endraw %}{% if use_windows_in_ci %}          - {{ gha_windows_runner }}{% endif %}{% raw %}
        python-version:
{% endraw %}{% for item in python_ci_versions %}
          - {{ item }}
{% endfor %}{% raw %}
        include:
          - os: "{% endraw %}{{ gha_linux_runner }}{% raw %}"
            python-version: "{% endraw %}{{ python_ci_versions[0] }}{% raw %}"
            JOB_MATCHING_DEV_ENV: true

    runs-on: ${{ matrix.os }}
    env:
      UV_PYTHON: ${{ matrix.python-version }}

    steps:
      - name: Checkout code
        uses: actions/checkout@{% endraw %}{{ gha_checkout }}{% raw %}
      - name: Setup python
        uses: actions/setup-python@{% endraw %}{{ gha_setup_python }}{% raw %}
        with:
          python-version: ${{ matrix.python-version }}
{% endraw %}{% if python_package_registry == "PyPI" %}{% raw %}
      - name: Sleep to allow PyPI Index to update before proceeding to the next step
        uses: juliangruber/sleep-action@{% endraw %}{{ gha_sleep }}{% raw %}
        with:
          time: 90s{% endraw %}{% endif %}{% raw %}
      - name: Install from staging registry
        run: pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://www.pypi.org/simple {% endraw %}{{ package_name | replace('_', '-') }}{% raw %}==${{ needs.get-values.outputs.package-version }}
      - name: Display dependencies
        run: pip list
      - name: Confirm library can be imported successfully
        run: python -c "import sys; print(f'Python version {sys.version}'); import {% endraw %}{{ package_name | replace('-', '_') }}{% raw %}"

  create-tag:
    name: Create the git tag
    if: ${{ github.event.inputs.publish_to_primary }}
    needs: [ install-from-staging ]
    permissions:
      contents: write # needed to push the tag
    runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
    steps:
      - name: Checkout code
        uses: actions/checkout@{% endraw %}{{ gha_checkout }}{% raw %}
      - name: Setup python
        uses: actions/setup-python@{% endraw %}{{ gha_setup_python }}{% raw %}
        with:
          python-version: {% endraw %}{{ python_version }}{% raw %}
      - name: Confirm tag not already present
        run: python3 ./.github/workflows/git_tag.py --confirm-tag-not-present
      - name: Create tag
        run: python3 ./.github/workflows/git_tag.py --push-tag-to-remote

  publish-to-primary:
    name: Publish Python distribution to Primary Package Registry
    if: ${{ github.event.inputs.publish_to_primary }}
    needs: [ create-tag ]
    runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
    environment:
      name: pypi
      url: https://pypi.org/p/{% endraw %}{{ package_name | replace('_', '-') }}{% raw %}
    permissions:
      attestations: write
      id-token: write
    steps:
      - name: Download all the dists
        uses: actions/download-artifact@{% endraw %}{{ gha_download_artifact }}{% raw %}
        with:
          name: python-package-distributions
          path: dist/
{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %}
      - name: OIDC Auth for Publishing to CodeArtifact
        uses: aws-actions/configure-aws-credentials@{% endraw %}{{ gha_configure_aws_credentials }}{% raw %}
        with:
          role-to-assume: arn:aws:iam::{% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %}:role/GHA-CA-Primary-{% endraw %}{{ repo_name }}{% raw %}
          aws-region: {% endraw %}{{ aws_org_home_region }}{% raw %}

      - name: Publish distribution to Code Artifact
        run: |
          . .devcontainer/code-artifact-auth.sh
          uv publish --verbose --index code-artifact-primary --username aws --password "$TWINE_PASSWORD"

{% endraw %}{% else %}{% raw %}
      - name: Publish distribution to PyPI
        uses: pypa/gh-action-pypi-publish@{% endraw %}{{ gha_pypi_publish }}{% raw %}
        with:
          attestations: false{% endraw %}{% endif %}{% raw %}

  install-from-primary:
    name: Install package from primary registry
    if: ${{ github.event.inputs.publish_to_primary }}
    needs: [ publish-to-primary, get-values ]
    strategy:
      matrix:
        os:
          - "{% endraw %}{{ gha_linux_runner }}{% raw %}"
{% endraw %}{% if use_windows_in_ci %}          - {{ gha_windows_runner }}{% endif %}{% raw %}
        python-version:
{% endraw %}{% for item in python_ci_versions %}
          - {{ item }}
{% endfor %}{% raw %}
        include:
          - os: "{% endraw %}{{ gha_linux_runner }}{% raw %}"
            python-version: "{% endraw %}{{ python_ci_versions[0] }}{% raw %}"
            JOB_MATCHING_DEV_ENV: true

    runs-on: ${{ matrix.os }}
    env:
      UV_PYTHON: ${{ matrix.python-version }}

    steps:
      - name: Checkout code
        uses: actions/checkout@{% endraw %}{{ gha_checkout }}{% raw %}
      - name: Setup python
        uses: actions/setup-python@{% endraw %}{{ gha_setup_python }}{% raw %}
        with:
          python-version: ${{ matrix.python-version }}
{% endraw %}{% if python_package_registry == "PyPI" %}{% raw %}
      - name: Sleep to allow PyPI Index to update before proceeding to the next step
        uses: juliangruber/sleep-action@{% endraw %}{{ gha_sleep }}{% raw %}
        with:
          time: 90s{% endraw %}{% endif %}{% raw %}
      - name: Install from primary registry
        run: pip install {% endraw %}{{ package_name | replace('_', '-') }}{% raw %}==${{ needs.get-values.outputs.package-version }}
      - name: Display dependencies
        run: pip list
      - name: Confirm library can be imported successfully
        run: python -c "import sys; print(f'Python version {sys.version}'); import {% endraw %}{{ package_name | replace('-', '_') }}{% raw %}"{% endraw %}