release.yaml

# Copyright (c) 2024-2026 CRS4
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This workflow is triggered on push to tags and runs the following steps:
# 1. Check and Build Distribution
# 2. Publish to TestPyPI
# 3. Publish to PyPI if the previous step is successful
# 4. Sign Distribution with Sigstore
# 5. Create GitHub Release with the signed distribution
name: 📦 CI Pipeline 2 -- Release

# Controls when the action will run. Triggers the workflow on push or pull request
# events but only for the master branch
on:
    push:
        tags:
            - "*.*.*"
        paths:
            - "**"
            - "!docs/**"
            - "!examples/**"

env:
    TERM: xterm
    VENV_PATH: .venv

jobs:
    # Run the test workflow as a prerequisite for release builds.
    test:
        name: 🧪 Run tests
        uses: ./.github/workflows/testing.yaml
        if: ${{ github.repository == 'crs4/rocrate-validator' }}
    # Check and Build Distribution
    build:
        name: 🏗 Check and Build Distribution
        runs-on: ubuntu-latest
        needs: test
        if: ${{ github.repository == 'crs4/rocrate-validator' }}
        steps:
            # Checkout the commit associated with the release tag.
            - name: ⬇️ Checkout code
              uses: actions/checkout@v7
            - name: 🐍 Set up Python
              uses: actions/setup-python@v7
              with:
                  python-version: "3.x"
            - name: 🚧 Set up Python Environment
              run: |
                  pip install --upgrade pip
                  pip install poetry
            - name: 📦 Install Package Dependencies
              run: poetry install --no-interaction --no-ansi
            - name: ✅ Check version
              run: |
                  if [ "${{ github.event_name }}" == "push" ] && [ "${{ github.ref_type }}" == "tag" ]; then
                    declared_version=$(poetry version -s)
                    echo "Checking tag '${{ github.ref }}' against package version $declared_version"
                    if [ "${{ github.ref }}" != "refs/tags/$declared_version" ]; then
                      echo "Tag '${{ github.ref }}' does not match the declared package version '$declared_version'"
                      exit 1
                    else
                      echo "Tag '${{ github.ref }}' matches the declared package version '$declared_version'"
                    fi
                  fi
            - name: 🏗️ Build a binary wheel and a source tarball
              run: poetry build
            - name: 📦 Store the distribution packages
              uses: actions/upload-artifact@v7
              with:
                  name: python-package-distributions
                  path: |
                      dist/*.whl
                      dist/*.tar.gz

    # Publish to TestPyPI
    publish-to-testpypi:
        name: 📦 Publish to TestPyPI
        runs-on: ubuntu-latest
        needs: build
        environment:
            name: testpypi
            url: https://test.pypi.org/p/roc-validator
        permissions:
            id-token: write # IMPORTANT: mandatory for trusted publishing
        steps:
            - name: ⬇️ Download all the distribution packages
              uses: actions/download-artifact@v8
              with:
                  name: python-package-distributions
                  path: dist/
            - name: 📦 Publish distribution to TestPyPI
              uses: pypa/gh-action-pypi-publish@release/v1
              with:
                  repository-url: https://test.pypi.org/legacy/

    # Publish to PyPI
    publish-to-pypi:
        name: 📦 Publish to PyPI
        runs-on: ubuntu-latest
        needs: [build, publish-to-testpypi]
        environment:
          name: pypi
          url: https://pypi.org/p/roc-validator
        permissions:
          id-token: write  # IMPORTANT: mandatory for trusted publishing
        steps:
        - name: ⬇️ Download all the dists
          uses: actions/download-artifact@v8
          with:
            name: python-package-distributions
            path: dist/
        - name: 📦 Publish distribution to PyPI
          uses: pypa/gh-action-pypi-publish@release/v1

    # Sign and Upload to GitHub Release
    sign-packages:
        name: 🖊️ Sign the Python distribution with Sigstore
        needs: publish-to-pypi
        runs-on: ubuntu-latest

        permissions:
            contents: write # IMPORTANT: mandatory for making GitHub Releases
            id-token: write # IMPORTANT: mandatory for sigstore

        steps:
            - name: ⬇️ Download all the distribution packages
              uses: actions/download-artifact@v8
              with:
                  name: python-package-distributions
                  path: dist/
            - name: 🖊️ Sign the dists with Sigstore
              uses: sigstore/gh-action-sigstore-python@v3.5.0
              with:
                  inputs: >-
                      ./dist/*.tar.gz
                      ./dist/*.whl
            - name: 📦 Store the signed distribution packages
              uses: actions/upload-artifact@v7
              with:
                  name: python-package-signatures
                  path: dist/*.json

    # Create GitHub Release
    github_release:
        name: 🎉 Release on GitHub
        needs: sign-packages
        runs-on: ubuntu-latest
        permissions:
            contents: write # IMPORTANT: mandatory for making GitHub Releases
            id-token: write # IMPORTANT: mandatory for sigstore
        steps:
            - name: ⬇️ Download all the distribution packages
              uses: actions/download-artifact@v8
              with:
                  name: python-package-distributions
                  path: dist/
            - name: ⬇️ Download all the distribution signatures
              uses: actions/download-artifact@v8
              with:
                  name: python-package-signatures
                  path: dist/
            - name: 🎉 Create GitHub Release
              env:
                  GITHUB_TOKEN: ${{ github.token }}
              run: >-
                  gh release create
                  '${{ github.ref_name }}'
                  --repo '${{ github.repository }}'
                  --generate-notes
            - name: 📦 Upload artifacts to GitHub Release
              env:
                  GITHUB_TOKEN: ${{ github.token }}
              # Upload to GitHub Release using the `gh` CLI.
              # `dist/` contains the built packages, and the
              # sigstore-produced signatures and certificates.
              run: >-
                  gh release upload
                  '${{ github.ref_name }}' dist/**
                  --repo '${{ github.repository }}'