Skip to content

Commit e4e4ead

Browse files
LeereenLeereen
authored
Merge pull request #121 from LedgerHQ/lpa/reusable_pypi
Reusable Pypi deployment, with Artifactory
2 parents f190f89 + 20d2ace commit e4e4ead

File tree

1 file changed

+80
-56
lines changed

1 file changed

+80
-56
lines changed

‎.github/workflows/reusable_pypi_deployment.yml‎

Lines changed: 80 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -3,23 +3,25 @@ name: Build, check and deploy an package on pypi.org or test.pypi.org
33
on:
44
workflow_call:
55
inputs:
6-
stable_deployment:
7-
description: If the package is to be deployed on pypiorg (true) or test.pypi.org (false)
6+
package_name:
7+
description: The name of the package.
88
required: true
9-
type: boolean
9+
type: string
1010
package_directory:
11-
description: The directory where the Python package lies (where the setup.py or setup.cfg or pyproject.toml can be found)
12-
required: true
11+
description: The directory where the Python package lies (where the setup.py or setup.cfg or
12+
pyproject.toml can be found)
1313
type: string
14-
check_changelog_version:
15-
description: If true, a CHANGELOG.md file is expected in the `package_directory`. The workflow will check that its latest
16-
version matches the Python package version.
17-
required: true
18-
type: boolean
14+
default: .
1915
publish:
20-
description: Whether the package should be published (on pypi.org or test.pypi.org depending on `stable_deployment`) or not
16+
description: Whether the package should be published or not
2117
required: true
2218
type: boolean
19+
jfrog_deployment:
20+
description: If the Python package should be pushed on Ledger Jfrog or not.
21+
Ignored if `publish` is `false`.
22+
type: boolean
23+
required: false
24+
default: true
2325
secrets:
2426
pypi_token:
2527
description: A token enabling to push a package on pypi.org or test.pypi.org
@@ -29,68 +31,90 @@ on:
2931
jobs:
3032
package_and_deploy:
3133
name: Build and deploy a Python Package
32-
runs-on: ubuntu-22.04
34+
runs-on: public-ledgerhq-shared-small
35+
permissions:
36+
id-token: write
37+
attestations: write
38+
contents: write
3339
steps:
3440

3541
- name: Clone
3642
uses: actions/checkout@v4
3743
with:
3844
fetch-depth: 0
3945

40-
- name: Configure target deploiement repository
41-
run: |
42-
if [ "${{ inputs.stable_deployment }}" = "true" ];
43-
then
44-
echo "DEPLOYMENT_TARGET=https://pypi.org/simple/" >> "$GITHUB_ENV";
45-
else
46-
echo "DEPLOYMENT_TARGET=https://test.pypi.org/simple/" >> "$GITHUB_ENV";
47-
fi
48-
49-
- name: Display current parameters
50-
run: |
51-
echo "Parameters are:"
52-
echo "- Stable deployment: ${{ inputs.stable_deployment }}"
53-
echo "- Will be deployed: ${{ inputs.publish }}"
54-
echo "- If deployed, will be on ${{ env.DEPLOYMENT_TARGET }}"
55-
56-
- name: Check Python package dependencies and local install
46+
- name: Build Python package
5747
run: |
48+
# Needed to workaround this bug https://github.com/pypa/setuptools/issues/4759
49+
# To be removed when it's fixed
50+
pip install -U packaging
51+
pip install --upgrade pip build twine
5852
cd ${{ inputs.package_directory }}
59-
pip install -v --extra-index-url ${{ env.DEPLOYMENT_TARGET }} .
53+
python -m build
54+
pip install .
55+
python -m twine check dist/*
56+
echo "TAG_VERSION=$(python -c 'from ${{ inputs.package_name }} import __version__; print(__version__)')" >> "$GITHUB_ENV"
6057
61-
# Fetching dependencies from test.pypi,org or pypi.org depending on the package destination:
62-
# tag -> pypi.org, not tag -> test.pypi.org
63-
- name: Build and check Python package
58+
- name: Display current status
6459
run: |
65-
cd ${{ inputs.package_directory }}
66-
pip install --upgrade pip build twine
67-
PIP_EXTRA_INDEX_URL=${{ env.DEPLOYMENT_TARGET }} python -m build
68-
python -m twine check dist/*
60+
echo "- Tag version: ${{ env.TAG_VERSION }}"
6961
7062
- name: Check version against CHANGELOG
71-
if: inputs.check_changelog_version
63+
if: ${{ success() && inputs.publish }}
7264
run: |
73-
PACKAGE_VERSION=$(find "${{ inputs.package_directory }}/dist" -name *.tar.gz | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+')
74-
CHANGELOG_VERSION=$(grep -Po '(?<=## \[)(\d+\.)+[^\]]' "${{ inputs.package_directory }}/CHANGELOG.md" | head -n 1)
75-
if [ "${PACKAGE_VERSION}" = "${CHANGELOG_VERSION}" ];
65+
CHANGELOG_VERSION=$(grep -Po '(?<=## \[)(\d+\.)+[^\]]' CHANGELOG.md | head -n 1)
66+
if [ "${{ env.TAG_VERSION }}" == "${CHANGELOG_VERSION}" ]
7667
then
77-
exit 0;
78-
else
79-
echo "Tag '${PACKAGE_VERSION}' and CHANGELOG '${CHANGELOG_VERSION}' versions mismatch!";
80-
exit 1;
68+
exit 0
8169
fi
70+
echo "Tag '${{ env.TAG_VERSION }}' and CHANGELOG '${CHANGELOG_VERSION}' versions mismatch!"
71+
exit 1
8272
83-
- name: Publish Python package on pypi.org or test.pypi.org
84-
if: inputs.publish
85-
run: |
86-
cd ${{ inputs.package_directory }}
87-
if [ "${{ inputs.stable_deployment }}" = "true" ];
88-
then
89-
python -m twine upload dist/*;
90-
else
91-
python -m twine upload --repository testpypi dist/*;
92-
fi
73+
- name: Publish Python package on pypi.org
74+
if: ${{ success() && inputs.publish }}
75+
run: python -m twine upload ${{ inputs.package_directory }}/dist/*
9376
env:
9477
TWINE_USERNAME: __token__
95-
TWINE_PASSWORD: ${{ secrets.pypi_token }}
78+
TWINE_PASSWORD: ${{ secrets.pypi_token }}
9679
TWINE_NON_INTERACTIVE: 1
80+
81+
- name: Login to Ledger Artifactory
82+
if: ${{ success() && inputs.publish && inputs.jfrog_deployment }}
83+
timeout-minutes: 10
84+
id: jfrog-login
85+
uses: LedgerHQ/actions-security/actions/jfrog-login@actions/jfrog-login-1
86+
87+
- name: Publish Python package on Ledger Artifactory
88+
if: ${{ success() && inputs.publish && inputs.jfrog_deployment }}
89+
run: python -m twine upload ${{ inputs.package_directory }}/dist/*
90+
env:
91+
TWINE_REPOSITORY_URL: https://jfrog.ledgerlabs.net/artifactory/api/pypi/embedded-apps-pypi-prod-green
92+
TWINE_USERNAME: ${{ steps.jfrog-login.outputs.oidc-user }}
93+
TWINE_PASSWORD: ${{ steps.jfrog-login.outputs.oidc-token }}
94+
TWINE_NON_INTERACTIVE: 1
95+
96+
- name: Generate library build attestations
97+
if: ${{ success() && inputs.publish && inputs.jfrog_deployment }}
98+
timeout-minutes: 10
99+
uses: LedgerHQ/actions-security/actions/attest@actions/attest-1
100+
with:
101+
subject-path: ${{ inputs.package_directory }}/dist/*
102+
103+
- name: Sign library artifacts
104+
if: ${{ success() && inputs.publish && inputs.jfrog_deployment }}
105+
timeout-minutes: 10
106+
uses: LedgerHQ/actions-security/actions/sign-blob@actions/sign-blob-1
107+
with:
108+
path: ${{ inputs.package_directory }}/dist
109+
110+
- name: Publish a release on the repo
111+
if: ${{ success() && inputs.publish }}
112+
uses: "marvinpinto/action-automatic-releases@latest"
113+
with:
114+
automatic_release_tag: "v${{ env.TAG_VERSION }}"
115+
repo_token: "${{ secrets.GITHUB_TOKEN }}"
116+
prerelease: false
117+
files: |
118+
LICENSE
119+
CHANGELOG.md
120+
${{ inputs.package_directory }}/dist/

0 commit comments

Comments
 (0)