tidy3d-python-client-deploy.yml

name: "public/tidy3d/python-client-deploy"

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: 'Release tag to deploy (e.g., v2.10.0, v2.10.0rc1)'
        required: true
        type: string
      
      deploy_testpypi:
        description: 'Deploy to TestPyPI (recommended first step)'
        type: boolean
        default: false
      
      deploy_pypi:
        description: 'Deploy to production PyPI'
        type: boolean
        default: false
  
  workflow_call:
    inputs:
      release_tag:
        description: 'Release tag to deploy'
        required: true
        type: string
      deploy_testpypi:
        type: boolean
        default: false
      deploy_pypi:
        type: boolean
        default: false
    secrets:
      TEST_PYPI_API_TOKEN:
        description: 'API token for uploading to TestPyPI'
        required: false
      PYPI_API_TOKEN:
        description: 'API token for uploading to PyPI'
        required: false

permissions:
  contents: read

jobs:
  validate-inputs:
    name: validate-deployment-inputs
    runs-on: ubuntu-latest
    outputs:
      release_tag: ${{ env.RELEASE_TAG }}
      deploy_testpypi: ${{ env.DEPLOY_TESTPYPI }}
      deploy_pypi: ${{ env.DEPLOY_PYPI }}
    env:
      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag || inputs.release_tag }}
      DEPLOY_TESTPYPI: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_testpypi || inputs.deploy_testpypi }}
      DEPLOY_PYPI: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_pypi || inputs.deploy_pypi }}
    steps:
      - name: validate-inputs
        run: |
          set -e
          echo "=== Deployment Configuration ==="
          echo "Release tag: $RELEASE_TAG"
          echo "Deploy to TestPyPI: $DEPLOY_TESTPYPI"
          echo "Deploy to PyPI: $DEPLOY_PYPI"
          echo ""
          
          # Validate at least one target is selected
          if [[ "$DEPLOY_TESTPYPI" != "true" && "$DEPLOY_PYPI" != "true" ]]; then
            echo "Error: At least one deployment target must be selected"
            exit 1
          fi
          
          # Validate tag format
          TAG_REGEX='^v[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+|\.dev[0-9]+)?$'
          if [[ ! "$RELEASE_TAG" =~ $TAG_REGEX ]]; then
            echo " Warning: Tag format doesn't match standard pattern v{major}.{minor}.{patch}[rc{num}|.dev{num}]"
            echo "   Tag: $RELEASE_TAG"
            echo "   Continuing anyway..."
          fi
          
          echo "Validation passed"

  build-package:
    name: build-distribution-package
    needs: validate-inputs
    runs-on: ubuntu-latest
    steps:
      - name: checkout-tag
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.validate-inputs.outputs.release_tag }}
          persist-credentials: false
      
      - name: setup-python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.10'
      
      - name: install-poetry
        run: |
          python -m pip install --upgrade pip
          python -m pip install poetry
      
      - name: build-package
        env:
          RELEASE_TAG: ${{ needs.validate-inputs.outputs.release_tag }}
        run: |
          echo "Building package from tag ${RELEASE_TAG}..."
          poetry build
          echo ""
          echo "Build artifacts:"
          ls -lh dist/
          echo ""
          echo "Package built successfully"
      
      - name: upload-artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: dist-${{ needs.validate-inputs.outputs.release_tag }}
          path: dist/
          retention-days: 7

  deploy-testpypi:
    name: deploy-to-testpypi
    needs: [validate-inputs, build-package]
    if: needs.validate-inputs.outputs.deploy_testpypi == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: download-artifacts
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          name: dist-${{ needs.validate-inputs.outputs.release_tag }}
          path: dist/
      
      - name: setup-python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.10'
      
      - name: install-twine
        run: |
          python -m pip install --upgrade pip
          python -m pip install twine
      
      - name: publish-to-testpypi
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.TEST_PYPI_API_TOKEN }}
        run: | # zizmor: ignore[use-trusted-publishing]
          echo "Publishing to TestPyPI..."
          python -m twine upload \
            --repository-url https://test.pypi.org/legacy/ \
            --verbose \
            dist/*
          echo ""
          echo "Successfully published to TestPyPI"
          echo "View at: https://test.pypi.org/project/tidy3d/"

  deploy-pypi:
    name: deploy-to-pypi
    needs: [validate-inputs, build-package]
    if: |
      always() &&
      needs.validate-inputs.outputs.deploy_pypi == 'true' &&
      needs.build-package.result == 'success'
    runs-on: ubuntu-latest
    steps:
      - name: download-artifacts
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          name: dist-${{ needs.validate-inputs.outputs.release_tag }}
          path: dist/
      
      - name: setup-python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.10'
      
      - name: install-twine
        run: |
          python -m pip install --upgrade pip
          python -m pip install twine
      
      - name: publish-to-pypi
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: | # zizmor: ignore[use-trusted-publishing]
          echo "Publishing to production PyPI..."
          python -m twine upload \
            --repository pypi \
            --verbose \
            dist/*
          echo ""
          echo "Successfully published to PyPI"
          echo "View at: https://pypi.org/project/tidy3d/"

  deployment-summary:
    name: deployment-summary
    needs: [validate-inputs, build-package, deploy-testpypi, deploy-pypi]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: generate-summary
        env:
          RELEASE_TAG: ${{ needs.validate-inputs.outputs.release_tag }}
          BUILD_RESULT: ${{ needs.build-package.result }}
          TESTPYPI_RESULT: ${{ needs.deploy-testpypi.result }}
          PYPI_RESULT: ${{ needs.deploy-pypi.result }}
          DEPLOY_TESTPYPI: ${{ needs.validate-inputs.outputs.deploy_testpypi }}
          DEPLOY_PYPI: ${{ needs.validate-inputs.outputs.deploy_pypi }}
        run: |
          echo "=== Deployment Summary ==="
          echo "Release Tag: ${RELEASE_TAG}"
          echo ""
          echo "Build Package: ${BUILD_RESULT}"
          echo "TestPyPI: ${TESTPYPI_RESULT}"
          echo "PyPI: ${PYPI_RESULT}"
          echo ""
          
          # Check for failures
          if [[ "${BUILD_RESULT}" == "failure" ]]; then
            echo "Build failed"
            exit 1
          fi
          
          # Check if any selected deployment failed
          failed=false
          if [[ "${DEPLOY_TESTPYPI}" == "true" && "${TESTPYPI_RESULT}" == "failure" ]]; then
            echo "TestPyPI deployment failed"
            failed=true
          fi
          if [[ "${DEPLOY_PYPI}" == "true" && "${PYPI_RESULT}" == "failure" ]]; then
            echo "PyPI deployment failed"
            failed=true
          fi
          
          if [[ "$failed" == "true" ]]; then
            exit 1
          fi
          
          echo "All selected deployments completed successfully"