|
| 1 | +{% raw %}name: Publish to Staging Package Registry |
| 2 | + |
| 3 | +on: |
| 4 | + workflow_dispatch: |
| 5 | + |
| 6 | +env: |
| 7 | + PYTHONUNBUFFERED: True |
| 8 | + PRE_COMMIT_HOME: ${{ github.workspace }}/.precommit_cache |
| 9 | + |
| 10 | +permissions: |
| 11 | + id-token: write |
| 12 | + contents: write # needed for mutex |
| 13 | + |
| 14 | +jobs: |
| 15 | + lint: |
| 16 | + name: Pre-commit |
| 17 | + runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %} |
| 18 | + steps: |
| 19 | + - name: Checkout code |
| 20 | + uses: actions/checkout@{% endraw %}{{ gha_checkout }}{% raw %} |
| 21 | + |
| 22 | + - name: Install latest versions of python packages |
| 23 | + uses: ./.github/actions/install_deps_uv |
| 24 | + with: |
| 25 | + python-version: {% endraw %}{{ python_version }}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %} |
| 26 | + code-artifact-auth-role-name: CoreInfraBaseAccess |
| 27 | + code-artifact-auth-role-account-id: {% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %} |
| 28 | + code-artifact-auth-region: {% endraw %}{{ aws_org_home_region }}{% endif %}{% raw %} |
| 29 | + |
| 30 | + - name: Set up mutex # Github concurrency management is horrible, things get arbitrarily cancelled if queued up. So using mutex until github fixes itself. When multiple jobs are modifying cache at once, weird things can happen. possible issue is https://github.com/actions/toolkit/issues/658 |
| 31 | + if: ${{ runner.os != 'Windows' }} # we're just gonna have to YOLO on Windows, because this action doesn't support it yet https://github.com/ben-z/gh-action-mutex/issues/14 |
| 32 | + uses: ben-z/gh-action-mutex@{% endraw %}{{ gha_mutex }}{% raw %} |
| 33 | + with: |
| 34 | + branch: mutex-venv-{% endraw %}{{ gha_linux_runner }}{% raw %}-py{% endraw %}{{ python_version }}{% raw %} |
| 35 | + timeout-minutes: 30 # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it |
| 36 | + |
| 37 | + - name: Cache Pre-commit hooks |
| 38 | + uses: actions/cache@{% endraw %}{{ gha_cache }}{% raw %} |
| 39 | + env: |
| 40 | + cache-name: cache-pre-commit-hooks |
| 41 | + with: |
| 42 | + path: ${{ env.PRE_COMMIT_HOME }} |
| 43 | + key: {% endraw %}{{ gha_linux_runner }}{% raw %}-py{% endraw %}{{ python_version }}{% raw %}-build-${{ env.cache-name }}-${{ hashFiles('.pre-commit-config.yaml') }} |
| 44 | + restore-keys: | |
| 45 | + {% endraw %}{{ gha_linux_runner }}{% raw %}-py{% endraw %}{{ python_version }}{% raw %}-build-${{ env.cache-name }}- |
| 46 | + |
| 47 | + - name: Run pre-commit |
| 48 | + run: pre-commit run -a |
| 49 | + |
| 50 | + test: |
| 51 | + needs: [ lint ] |
| 52 | + strategy: |
| 53 | + matrix: |
| 54 | + os: |
| 55 | + - "{% endraw %}{{ gha_linux_runner }}{% raw %}" |
| 56 | +{% endraw %}{% if use_windows_in_ci %} - {{ gha_windows_runner }}{% endif %}{% raw %} |
| 57 | + python-version: |
| 58 | +{% endraw %}{% for item in python_ci_versions %} |
| 59 | + - {{ item }} |
| 60 | +{% endfor %}{% raw %} |
| 61 | + include: |
| 62 | + - os: "{% endraw %}{{ gha_linux_runner }}{% raw %}" |
| 63 | + python-version: "{% endraw %}{{ python_ci_versions[0] }}{% raw %}" |
| 64 | + JOB_MATCHING_DEV_ENV: true |
| 65 | + |
| 66 | + runs-on: ${{ matrix.os }} |
| 67 | + |
| 68 | + steps: |
| 69 | + - name: Checkout code |
| 70 | + uses: actions/checkout@{% endraw %}{{ gha_checkout }}{% raw %} |
| 71 | + |
| 72 | + - name: Install python tooling |
| 73 | + uses: ./.github/actions/install_deps_uv |
| 74 | + with: |
| 75 | + python-version: ${{ matrix.python-version }}{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %} |
| 76 | + code-artifact-auth-role-name: CoreInfraBaseAccess |
| 77 | + code-artifact-auth-role-account-id: "{% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %}" |
| 78 | + code-artifact-auth-region: {% endraw %}{{ aws_org_home_region }}{% endif %}{% raw %} |
| 79 | + |
| 80 | + - name: Unit test |
| 81 | + run: uv run pytest --durations=5 |
| 82 | + |
| 83 | + build: |
| 84 | + needs: [ test ] |
| 85 | + runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %} |
| 86 | + |
| 87 | + steps: |
| 88 | + - name: Checkout code |
| 89 | + uses: actions/checkout@{% endraw %}{{ gha_checkout }}{% raw %} |
| 90 | + |
| 91 | + - name: Install python tooling |
| 92 | + uses: ./.github/actions/install_deps_uv |
| 93 | + with: |
| 94 | + python-version: {% endraw %}{{ python_version }}{% raw %}{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %} |
| 95 | + code-artifact-auth-role-name: CoreInfraBaseAccess |
| 96 | + code-artifact-auth-role-account-id: "{% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %}" |
| 97 | + code-artifact-auth-region: {% endraw %}{{ aws_org_home_region }}{% endif %}{% raw %} |
| 98 | +{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %} |
| 99 | + - name: OIDC Auth for Installing any dependencies that uv may need for build (sometimes it likes to install setuptools...even if it's already in the package dependencies) |
| 100 | + uses: aws-actions/configure-aws-credentials@{% endraw %}{{ gha_configure_aws_credentials }}{% raw %} |
| 101 | + with: |
| 102 | + role-to-assume: arn:aws:iam::{% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %}:role/CoreInfraBaseAccess |
| 103 | + aws-region: {% endraw %}{{ aws_org_home_region }}{% raw %} |
| 104 | + |
| 105 | +{% endraw %}{% endif %}{% raw %} |
| 106 | + - name: Build package |
| 107 | + run: | |
| 108 | +{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %} . .devcontainer/code-artifact-auth.sh{% endraw %}{% endif %}{% raw %} |
| 109 | + uv build --no-sources |
| 110 | +{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %} |
| 111 | + - name: OIDC Auth for Publishing to CodeArtifact |
| 112 | + uses: aws-actions/configure-aws-credentials@{% endraw %}{{ gha_configure_aws_credentials }}{% raw %} |
| 113 | + with: |
| 114 | + role-to-assume: arn:aws:iam::{% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %}:role/GHA-CA-Staging-{% endraw %}{{ repo_name }}{% raw %} |
| 115 | + aws-region: {% endraw %}{{ aws_org_home_region }}{% raw %} |
| 116 | + |
| 117 | +{% endraw %}{% endif %}{% raw %} |
| 118 | + |
| 119 | + - name: Publish package |
| 120 | + run: | |
| 121 | +{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %} . .devcontainer/code-artifact-auth.sh{% endraw %}{% endif %}{% raw %} |
| 122 | + uv publish --verbose --index {% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}code-artifact-staging --username aws --password "$TWINE_PASSWORD"{% else %}testpypi{% endif %} |
0 commit comments