release.yaml

# Copyright (c) 2024 Contributors to the Eclipse Foundation
#
# This program and the accompanying materials are made available under the
# terms of the Apache License, Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# SPDX-License-Identifier: Apache-2.0

name: Github Release and PyPi Publish

on:
  workflow_dispatch:
  push:
   tags:
     - "v*.*.*"

jobs:
  build:
    name: Build distribution 📦
    runs-on: ubuntu-22.04

    steps:
    - uses: actions/checkout@v4
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: "3.10"
    - name: Install pypa/build
      run: pip install build --user
    - name: Build a binary wheel and a source tarball
      run: python3 -m build
    - name: Store the distribution packages
      uses: actions/upload-artifact@v4
      with:
        name: python-package-distributions
        path: |
          dist/
          LICENSE
          NOTICE.md

  publish-to-pypi:
    name: Publish 🐍 to PyPI
    needs:
    - build
    runs-on: ubuntu-22.04
    environment:
      name: pypi
      url: https://pypi.org/p/velocitas-sdk

    permissions:
      id-token: write

    steps:
    - name: Download dists folder
      uses: actions/download-artifact@v4
      with:
        name: python-package-distributions
        path: python-package/
    - name: Publish distribution 📦 to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        packages-dir: python-package/dist

  github-release:
    name: >-
      Create GitHub Release
    needs:
    - build
    runs-on: ubuntu-22.04

    permissions:
      contents: write
      id-token: write

    steps:
    - name: Download dists folder
      uses: actions/download-artifact@v4
      with:
        name: python-package-distributions
        path: python-package/
    - name: Sign the dists with Sigstore
      # If running on your own fork/organization
      # you must assure that sigstore has been added as authroized OAuth app in Github
      # Can be triggered by a manual run on CLI like "sigstore sign <somefile>"
      uses: sigstore/gh-action-sigstore-python@v3.0.0
      with:
        inputs: >-
          ./python-package/dist/*.tar.gz
          ./python-package/dist/*.whl
    - name: Create release
      id: create_release
      uses: softprops/action-gh-release@v2
      with:
        files: |
          python-package/dist/**
          python-package/LICENSE
          python-package/NOTICE.md