release.yml

name: release

# based off of https://github.com/astral-sh/ruff/blob/main/.github/workflows/release.yaml
on:
  workflow_dispatch:
    inputs:
      tag:
        description: "The version to tag (without the leading 'v'). If omitted, will initiate a dry run (no uploads)."
        default: ""
        type: string
      branch:
        description: "The branch from which to release."
        type: string
      prerelease:
        description: "Whether the release is a pre-release."
        default: false
        type: boolean

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate-tag:
    name: Validate tag
    runs-on: ubuntu-latest
    # If you don't set an input tag, it's a dry run (no uploads).
    if: ${{ inputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.branch }}

      - name: Check tag consistency
        run: |
          # Switch to the commit we want to release
          git checkout ${{ inputs.branch }}
          version=$(grep "^version = " pyproject.toml | sed -e 's/version = "\(.*\)"/\1/g')
          if [ "${{ inputs.tag }}" != "${version}" ]; then
            echo "The input tag does not match the version from pyproject.toml:" >&2
            echo "${{ inputs.tag }}" >&2
            echo "${version}" >&2
            exit 1
          else
            echo "Releasing ${version}"
          fi

  tag-release:
    name: Tag release
    runs-on: ubuntu-latest
    needs: validate-tag
    # If you don't set an input tag, it's a dry run (no uploads).
    if: ${{ inputs.tag }}
    permissions:
      # For git tag
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.branch }}

      - name: git tag
        run: |
          git config --global user.email "martin.kim@scverse.org"
          git config --global user.name "scvi-tools release"
          git tag -m "${{ inputs.tag }}" "${{ inputs.tag }}"
          # If there is duplicate tag, this will fail. The publish to pypi action will have been a noop (due to skip
          # existing), so we make a non-destructive exit here
          git push --tags

  publish-release:
    name: Publish to GitHub
    runs-on: ubuntu-latest
    needs: tag-release
    # If you don't set an input tag, it's a dry run (no uploads).
    if: ${{ inputs.tag }}
    permissions:
      # For GitHub release publishing
      contents: write

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.branch }}

      - uses: softprops/action-gh-release@v2
        with:
          name: scvi-tools ${{ inputs.tag }}
          tag_name: ${{ inputs.tag }}
          generate_release_notes: false
          body_path: .github/workflows/release_notes.md
          prerelease: ${{ inputs.prerelease }}
          target_commitish: ${{ inputs.branch }}

  upload-release:
    runs-on: ubuntu-latest
    needs: tag-release
    environment:
      name: pypi
      url: https://pypi.org/p/scvi-tools
    permissions:
      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
    # If you don't set an input tag, it's a dry run (no uploads).
    if: ${{ inputs.tag }}

    steps:
      - uses: actions/checkout@v4
        with:
          filter: blob:none
          fetch-depth: 0
          ref: ${{ inputs.branch }}

      - uses: actions/setup-python@v4
        with:
          python-version: "3.11"

      - run: pip install build

      - run: python -m build

      - uses: pypa/gh-action-pypi-publish@release/v1

  build-image:
    runs-on: ubuntu-latest
    needs: tag-release

    permissions:
      contents: read
      packages: write

    strategy:
      fail-fast: false
      matrix:
        dependencies: ["", "dev", "tutorials"]
    # If you don't set an input tag, it's a dry run (no uploads).
    if: ${{ inputs.tag }}

    steps:
      - uses: actions/checkout@v4
        with:
          filter: blob:none
          fetch-depth: 0
          ref: ${{ inputs.branch }}

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          push: true
          cache-from: type=registry,ref=ghcr.io/scverse/scvi-tools:buildcache
          cache-to: type=inline,ref=ghcr.io/scverse/scvi-tools:buildcache
          target: build
          tags: ghcr.io/scverse/scvi-tools:py3.11-cu12-${{ inputs.tag }}-${{ matrix.dependencies }},ghcr.io/scverse/scvi-tools:py3.11-cu12-stable-${{ matrix.dependencies }}
          build-args: |
            DEPENDENCIES=${{ matrix.dependencies }}