Skip to content

Commit f41a69f

Browse files
blink1073blink1073
authored
Merge pull request #7 from blink1073/INTPYTHON-615
INTPYTHON-615 Set up GitHub workflows for automated releases
2 parents 6c7fdea + 210e3e4 commit f41a69f

File tree

8 files changed

+332
-78
lines changed

8 files changed

+332
-78
lines changed

‎.github/workflows/codeql.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: [ "main", "*" ]
17+
pull_request:
18+
branches: [ "main", "*" ]
19+
schedule:
20+
- cron: '35 23 * * 5'
21+
workflow_call:
22+
inputs:
23+
ref:
24+
required: true
25+
type: string
26+
27+
jobs:
28+
analyze:
29+
name: Analyze ${{ matrix.language }}
30+
runs-on: ubuntu-latest
31+
timeout-minutes: 360
32+
permissions:
33+
# required for all workflows
34+
security-events: write
35+
# required to fetch internal or private CodeQL packs
36+
packages: read
37+
actions: read
38+
contents: read
39+
strategy:
40+
fail-fast: false
41+
matrix:
42+
include:
43+
- language: python
44+
- language: actions
45+
46+
steps:
47+
- name: Checkout repository
48+
uses: actions/checkout@v4
49+
with:
50+
ref: ${{ inputs.ref }}
51+
persist-credentials: false
52+
- name: Set up Python
53+
uses: actions/setup-python@v4
54+
with:
55+
python-version: "3.10"
56+
57+
# Initializes the CodeQL tools for scanning.
58+
- name: Initialize CodeQL
59+
uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3
60+
with:
61+
languages: ${{ matrix.language }}
62+
build-mode: none
63+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
64+
queries: security-extended
65+
config: |
66+
paths-ignore:
67+
- 'test/**'
68+
69+
- shell: bash
70+
if: matrix.language == 'python'
71+
run: |
72+
pip install -e .
73+
74+
- name: Perform CodeQL Analysis
75+
uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 # v3
76+
with:
77+
category: "/language:${{ matrix.language }}"

‎.github/workflows/dist.yml

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Python Dist
2+
3+
on:
4+
push:
5+
tags:
6+
- "[0-9]+.[0-9]+.[0-9]+"
7+
- "[0-9]+.[0-9]+.[0-9]+.post[0-9]+"
8+
- "[0-9]+.[0-9]+.[0-9]+[a-b][0-9]+"
9+
- "[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
10+
workflow_dispatch:
11+
pull_request:
12+
workflow_call:
13+
inputs:
14+
ref:
15+
required: true
16+
type: string
17+
18+
permissions:
19+
contents: read
20+
actions: read
21+
22+
concurrency:
23+
group: dist-${{ github.ref }}
24+
cancel-in-progress: true
25+
26+
defaults:
27+
run:
28+
shell: bash -eux {0}
29+
30+
jobs:
31+
make_dist:
32+
name: Make Dist
33+
runs-on: macos-latest
34+
steps:
35+
- uses: actions/checkout@v4
36+
with:
37+
persist-credentials: false
38+
39+
- uses: actions/setup-python@v5
40+
with:
41+
# Build sdist on lowest supported Python
42+
python-version: '3.10'
43+
44+
- name: Install python requirements
45+
run: |
46+
python -m pip install uv rust-just build
47+
48+
- name: Build Dist
49+
run: |
50+
python -m build .
51+
52+
- name: Test SDist
53+
run: |
54+
python -m pip install dist/*.gz
55+
cd ..
56+
python -c "from pymongo_voyageai import PyMongoVoyageAI"
57+
58+
- uses: actions/upload-artifact@v4
59+
with:
60+
name: "dist"
61+
path: ./dist/*.*
62+
63+
collect_dist:
64+
runs-on: ubuntu-latest
65+
needs: [make_dist]
66+
name: Download Dist
67+
steps:
68+
- name: Download all workflow run artifacts
69+
uses: actions/download-artifact@v4
70+
- name: Flatten directory
71+
working-directory: .
72+
run: |
73+
find . -mindepth 2 -type f -exec mv {} . \;
74+
find . -type d -empty -delete
75+
- uses: actions/upload-artifact@v4
76+
with:
77+
name: all-dist-${{ github.run_id }}
78+
path: "./*"

‎.github/workflows/release-python.yml

Lines changed: 91 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,25 @@
1-
name: Python Wheels
1+
name: Release
22

33
on:
4-
push:
5-
branches: ["main"]
6-
tags:
7-
- "**"
8-
pull_request:
94
workflow_dispatch:
5+
inputs:
6+
following_version:
7+
description: "The post (dev) version to set"
8+
dry_run:
9+
description: "Dry Run?"
10+
default: false
11+
type: boolean
12+
schedule:
13+
- cron: '30 5 * * *'
14+
15+
env:
16+
# Changes per repo
17+
PRODUCT_NAME: python-bsonjs
18+
# Constant
19+
# inputs will be empty on a scheduled run. so, we only set dry_run
20+
# to 'false' when the input is set to 'false'.
21+
DRY_RUN: ${{ ! contains(inputs.dry_run, 'false') }}
22+
FOLLOWING_VERSION: ${{ inputs.following_version || '' }}
1023

1124
concurrency:
1225
group: wheels-${{ github.ref }}
@@ -17,83 +30,94 @@ defaults:
1730
shell: bash -eux {0}
1831

1932
jobs:
20-
21-
build_dist:
22-
name: Build Distribution Files
33+
pre-publish:
34+
environment: release
2335
runs-on: ubuntu-latest
36+
if: github.repository_owner == 'mongodb-labs' || github.event_name == 'workflow_dispatch'
37+
permissions:
38+
id-token: write
39+
contents: write
40+
outputs:
41+
version: ${{ steps.pre-publish.outputs.version }}
2442
steps:
25-
- uses: actions/checkout@v4
43+
- uses: mongodb-labs/drivers-github-tools/secure-checkout@v2
2644
with:
27-
fetch-depth: 0
28-
persist-credentials: false
29-
30-
- uses: actions/setup-python@v5
45+
app_id: ${{ vars.APP_ID }}
46+
private_key: ${{ secrets.APP_PRIVATE_KEY }}
47+
- uses: mongodb-labs/drivers-github-tools/setup@v2
3148
with:
32-
# Build sdist on lowest supported Python
33-
python-version: '3.10'
34-
35-
- name: Install build
36-
run: |
37-
python -m pip install build
38-
39-
- name: build the dist files
40-
run: |
41-
python -m build .
42-
43-
- name: Upload the dist files
44-
uses: actions/upload-artifact@v4
45-
with:
46-
name: dist-${{ github.run_id }}
47-
path: ./dist/*.*
48-
49-
test_dist:
50-
needs: [build_dist]
51-
name: Test Distribution Files
52-
runs-on: ubuntu-latest
53-
steps:
54-
- uses: actions/checkout@v4
55-
with:
56-
fetch-depth: 0
57-
persist-credentials: false
58-
59-
- uses: actions/setup-python@v5
49+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
50+
aws_region_name: ${{ vars.AWS_REGION_NAME }}
51+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
52+
artifactory_username: ${{ vars.ARTIFACTORY_USERNAME }}
53+
- uses: mongodb-labs/drivers-github-tools/python-labs/pre-publish@v2
54+
id: pre-publish
6055
with:
61-
# Build sdist on lowest supported Python
62-
python-version: '3.10'
56+
dry_run: ${{ env.DRY_RUN }}
6357

64-
- name: Download the dists
65-
uses: actions/download-artifact@v4
66-
with:
67-
name: dist-${{ github.run_id }}
68-
path: dist/
69-
70-
- name: Test the sdist
71-
run: |
72-
cd dist
73-
pip install *.tar.gz
74-
python -c "import pymongo_voyageai"
75-
pip uninstall -y pymongo_voyageai
58+
build-dist:
59+
needs: [pre-publish]
60+
uses: ./.github/workflows/dist.yml
61+
permissions:
62+
contents: read
63+
with:
64+
ref: ${{ needs.pre-publish.outputs.version }}
7665

77-
- name: Test the wheel
78-
run: |
79-
cd dist
80-
pip install *.whl
81-
python -c "import pymongo_voyageai"
82-
pip uninstall -y pymongo_voyageai
66+
static-scan:
67+
needs: [pre-publish]
68+
uses: ./.github/workflows/codeql.yml
69+
permissions:
70+
contents: read
71+
with:
72+
ref: ${{ needs.pre-publish.outputs.version }}
8373

8474
publish:
8575
# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#publishing-the-distribution-to-pypi
86-
needs: [test_dist]
87-
if: startsWith(github.ref, 'refs/tags/')
76+
needs: [build-dist, static-scan]
77+
if: (github.repository_owner == 'mongodb-labs' && github.event_name != 'pull_request') || github.event_name == 'workflow_dispatch'
8878
runs-on: ubuntu-latest
8979
environment: release
9080
permissions:
9181
id-token: write
9282
steps:
93-
- name: Download the dists
83+
- name: Download all the dists
9484
uses: actions/download-artifact@v4
9585
with:
96-
name: dist-${{ github.run_id }}
86+
name: all-dist-${{ github.run_id }}
9787
path: dist/
88+
- name: Publish package distributions to TestPyPI
89+
uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
90+
with:
91+
repository-url: https://test.pypi.org/legacy/
92+
skip-existing: true
93+
attestations: ${{ env.DRY_RUN }}
9894
- name: Publish distribution 📦 to PyPI
99-
uses: pypa/gh-action-pypi-publish@release/v1
95+
if: startsWith(env.DRY_RUN, 'false')
96+
uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
97+
98+
post-publish:
99+
needs: [publish]
100+
runs-on: ubuntu-latest
101+
environment: release
102+
permissions:
103+
id-token: write
104+
contents: write
105+
attestations: write
106+
security-events: write
107+
steps:
108+
- uses: mongodb-labs/drivers-github-tools/secure-checkout@v2
109+
with:
110+
app_id: ${{ vars.APP_ID }}
111+
private_key: ${{ secrets.APP_PRIVATE_KEY }}
112+
- uses: mongodb-labs/drivers-github-tools/setup@v2
113+
with:
114+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
115+
aws_region_name: ${{ vars.AWS_REGION_NAME }}
116+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
117+
artifactory_username: ${{ vars.ARTIFACTORY_USERNAME }}
118+
- uses: mongodb-labs/drivers-github-tools/python-labs/post-publish@v2
119+
with:
120+
following_version: ${{ env.FOLLOWING_VERSION }}
121+
product_name: ${{ env.PRODUCT_NAME }}
122+
token: ${{ github.token }}
123+
dry_run: ${{ env.DRY_RUN }}

0 commit comments

Comments
 (0)