Skip to content

Commit f90dc1c

Browse files
evertlammertsevertlammerts
committed
Testing secrets and reusable workflows
1 parent ff6a34f commit f90dc1c

File tree

2 files changed

+94
-82
lines changed

2 files changed

+94
-82
lines changed

‎.github/workflows/cleanup_pypi.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,13 @@ on:
66
description: CI environment to run in (pypi-test or pypi-prod-nightly)
77
type: string
88
required: true
9+
secrets:
10+
PYPI_CLEANUP_OTP:
11+
description: PyPI OTP
12+
required: true
13+
PYPI_CLEANUP_PASSWORD:
14+
description: PyPI password
15+
required: true
916
workflow_dispatch:
1017
inputs:
1118
dry-run:

‎.github/workflows/release.yml‎

Lines changed: 87 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -28,55 +28,55 @@ defaults:
2828
shell: bash
2929

3030
jobs:
31-
build_and_test:
32-
name: Build and test releases
33-
uses: ./.github/workflows/packaging.yml
34-
with:
35-
minimal: true
36-
testsuite: none
37-
git-ref: ${{ github.ref }}
38-
duckdb-git-ref: ${{ inputs.duckdb-sha }}
39-
set-version: ${{ inputs.stable-version }}
40-
41-
upload_s3:
42-
name: Upload Artifacts to S3
43-
runs-on: ubuntu-latest
44-
needs: [build_and_test]
45-
if: ${{ github.repository_owner == 'duckdb' && ( inputs.pypi-index == 'prod' || inputs.store-s3 ) }}
46-
steps:
47-
- name: Fetch artifacts
48-
uses: actions/download-artifact@v4
49-
with:
50-
pattern: '{sdist,wheel}*'
51-
path: artifacts/
52-
merge-multiple: true
53-
54-
- name: Authenticate with AWS
55-
uses: aws-actions/configure-aws-credentials@v4
56-
with:
57-
aws-region: 'us-east-2'
58-
aws-access-key-id: ${{ secrets.S3_DUCKDB_STAGING_ID }}
59-
aws-secret-access-key: ${{ secrets.S3_DUCKDB_STAGING_KEY }}
60-
61-
- name: Upload Artifacts
62-
id: s3_upload
63-
run: |
64-
sha=${{ github.ref }}
65-
aws s3 cp artifacts s3://duckdb-staging/${{ github.repository }}/${sha:0:10}/ --recursive
66-
67-
- name: S3 Upload Summary
68-
run : |
69-
sha=${{ github.ref }}
70-
version=$(basename artifacts/*.tar.gz | sed 's/duckdb-\(.*\).tar.gz/\1/g')
71-
echo "## S3 Upload Summary" >> $GITHUB_STEP_SUMMARY
72-
echo "* Version: ${version}" >> $GITHUB_STEP_SUMMARY
73-
echo "* SHA: ${sha:0:10}" >> $GITHUB_STEP_SUMMARY
74-
echo "* S3 URL: s3://duckdb-staging/${{ github.repository }}/${sha:0:10}/" >> $GITHUB_STEP_SUMMARY
31+
# build_and_test:
32+
# name: Build and test releases
33+
# uses: ./.github/workflows/packaging.yml
34+
# with:
35+
# minimal: true
36+
# testsuite: none
37+
# git-ref: ${{ github.ref }}
38+
# duckdb-git-ref: ${{ inputs.duckdb-sha }}
39+
# set-version: ${{ inputs.stable-version }}
40+
#
41+
# upload_s3:
42+
# name: Upload Artifacts to S3
43+
# runs-on: ubuntu-latest
44+
# needs: [build_and_test]
45+
# if: ${{ github.repository_owner == 'duckdb' && ( inputs.pypi-index == 'prod' || inputs.store-s3 ) }}
46+
# steps:
47+
# - name: Fetch artifacts
48+
# uses: actions/download-artifact@v4
49+
# with:
50+
# pattern: '{sdist,wheel}*'
51+
# path: artifacts/
52+
# merge-multiple: true
53+
#
54+
# - name: Authenticate with AWS
55+
# uses: aws-actions/configure-aws-credentials@v4
56+
# with:
57+
# aws-region: 'us-east-2'
58+
# aws-access-key-id: ${{ secrets.S3_DUCKDB_STAGING_ID }}
59+
# aws-secret-access-key: ${{ secrets.S3_DUCKDB_STAGING_KEY }}
60+
#
61+
# - name: Upload Artifacts
62+
# id: s3_upload
63+
# run: |
64+
# sha=${{ github.ref }}
65+
# aws s3 cp artifacts s3://duckdb-staging/${{ github.repository }}/${sha:0:10}/ --recursive
66+
#
67+
# - name: S3 Upload Summary
68+
# run : |
69+
# sha=${{ github.ref }}
70+
# version=$(basename artifacts/*.tar.gz | sed 's/duckdb-\(.*\).tar.gz/\1/g')
71+
# echo "## S3 Upload Summary" >> $GITHUB_STEP_SUMMARY
72+
# echo "* Version: ${version}" >> $GITHUB_STEP_SUMMARY
73+
# echo "* SHA: ${sha:0:10}" >> $GITHUB_STEP_SUMMARY
74+
# echo "* S3 URL: s3://duckdb-staging/${{ github.repository }}/${sha:0:10}/" >> $GITHUB_STEP_SUMMARY
7575

7676
determine_environment:
7777
name: Determine the Github Actions environment to use
7878
runs-on: ubuntu-latest
79-
needs: build_and_test
79+
# needs: build_and_test
8080
outputs:
8181
env_name: ${{ steps.set-env.outputs.env_name }}
8282
steps:
@@ -101,47 +101,52 @@ jobs:
101101
;;
102102
esac
103103
104-
publish_pypi:
105-
name: Publish Artifacts to PyPI
106-
runs-on: ubuntu-latest
107-
needs: determine_environment
108-
environment:
109-
name: ${{ needs.determine_environment.outputs.env_name }}
110-
permissions:
111-
# this is needed for the OIDC flow that is used with trusted publishing on PyPI
112-
id-token: write
113-
steps:
114-
- if: ${{ vars.PYPI_HOST == '' }}
115-
run: |
116-
echo "Error: PYPI_HOST is not set in CI environment '${{ needs.determine_environment.outputs.env_name }}'"
117-
exit 1
118-
119-
- name: Fetch artifacts
120-
uses: actions/download-artifact@v4
121-
with:
122-
pattern: '{sdist,wheel}*'
123-
path: packages/
124-
merge-multiple: true
125-
126-
- name: Upload artifacts to PyPI
127-
uses: pypa/gh-action-pypi-publish@release/v1
128-
with:
129-
repository-url: 'https://${{ vars.PYPI_HOST }}/legacy/'
130-
packages-dir: packages
131-
verbose: 'true'
132-
133-
- name: PyPI Upload Summary
134-
run : |
135-
version=$(basename packages/*.tar.gz | sed 's/duckdb-\(.*\).tar.gz/\1/g')
136-
echo "## PyPI Upload Summary" >> $GITHUB_STEP_SUMMARY
137-
echo "* Version: ${version}" >> $GITHUB_STEP_SUMMARY
138-
echo "* PyPI Host: ${{ vars.PYPI_HOST }}" >> $GITHUB_STEP_SUMMARY
139-
echo "* CI Environment: ${{ needs.determine_environment.outputs.env_name }}" >> $GITHUB_STEP_SUMMARY
104+
# publish_pypi:
105+
# name: Publish Artifacts to PyPI
106+
# runs-on: ubuntu-latest
107+
# needs: determine_environment
108+
# environment:
109+
# name: ${{ needs.determine_environment.outputs.env_name }}
110+
# permissions:
111+
# # this is needed for the OIDC flow that is used with trusted publishing on PyPI
112+
# id-token: write
113+
# steps:
114+
# - if: ${{ vars.PYPI_HOST == '' }}
115+
# run: |
116+
# echo "Error: PYPI_HOST is not set in CI environment '${{ needs.determine_environment.outputs.env_name }}'"
117+
# exit 1
118+
#
119+
# - name: Fetch artifacts
120+
# uses: actions/download-artifact@v4
121+
# with:
122+
# pattern: '{sdist,wheel}*'
123+
# path: packages/
124+
# merge-multiple: true
125+
#
126+
# - name: Upload artifacts to PyPI
127+
# uses: pypa/gh-action-pypi-publish@release/v1
128+
# with:
129+
# repository-url: 'https://${{ vars.PYPI_HOST }}/legacy/'
130+
# packages-dir: packages
131+
# verbose: 'true'
132+
#
133+
# - name: PyPI Upload Summary
134+
# run : |
135+
# version=$(basename packages/*.tar.gz | sed 's/duckdb-\(.*\).tar.gz/\1/g')
136+
# echo "## PyPI Upload Summary" >> $GITHUB_STEP_SUMMARY
137+
# echo "* Version: ${version}" >> $GITHUB_STEP_SUMMARY
138+
# echo "* PyPI Host: ${{ vars.PYPI_HOST }}" >> $GITHUB_STEP_SUMMARY
139+
# echo "* CI Environment: ${{ needs.determine_environment.outputs.env_name }}" >> $GITHUB_STEP_SUMMARY
140140

141141
cleanup_nightlies:
142142
name: Remove Nightlies from PyPI
143-
needs: [determine_environment, publish_pypi]
143+
# needs: [determine_environment, publish_pypi]
144+
needs: determine_environment
144145
if: ${{ inputs.stable-version == '' }}
145146
uses: ./.github/workflows/cleanup_pypi.yml
146147
with:
147148
environment: ${{ needs.determine_environment.outputs.env_name }}
149+
secrets:
150+
# reusable workflows and secrets are not great: https://github.com/actions/runner/issues/3206
151+
PYPI_CLEANUP_OTP: ${{secrets.PYPI_CLEANUP_OTP}}
152+
PYPI_CLEANUP_PASSWORD: ${{secrets.PYPI_CLEANUP_PASSWORD}}

0 commit comments

Comments
 (0)