|
1 | | -name: Run Release Please |
| 1 | +# This workflow handles both automated and manual package publishing: |
| 2 | +# |
| 3 | +# AUTOMATED PUBLISHING (on push to main): |
| 4 | +# - Triggered automatically when changes are pushed to the main branch |
| 5 | +# - Uses release-please to create releases based on conventional commits |
| 6 | +# - Publishes packages to PyPI automatically when release PRs are merged |
| 7 | +# |
| 8 | +# MANUAL PUBLISHING (via workflow_dispatch): |
| 9 | +# - Can be triggered manually from the Actions tab |
| 10 | +# - Allows publishing a specific package to PyPI |
| 11 | +# - Supports dry-run mode |
| 12 | +# |
| 13 | +name: release-please |
2 | 14 |
|
3 | 15 | on: |
4 | 16 | push: |
5 | | - branches: [ main ] |
| 17 | + branches: |
| 18 | + - main |
| 19 | + workflow_dispatch: |
| 20 | + inputs: |
| 21 | + workspace_path: |
| 22 | + description: 'The workspace to publish' |
| 23 | + required: true |
| 24 | + default: 'packages/sdk/server-ai' |
| 25 | + type: choice |
| 26 | + options: |
| 27 | + - packages/sdk/server-ai |
| 28 | + - packages/ai-providers/server-ai-langchain |
| 29 | + dry_run: |
| 30 | + description: 'Is this a dry run. If so no package will be published.' |
| 31 | + type: boolean |
| 32 | + required: true |
6 | 33 |
|
7 | 34 | jobs: |
8 | | - release-package: |
| 35 | + release-please: |
9 | 36 | runs-on: ubuntu-latest |
10 | 37 | permissions: |
11 | | - id-token: write # Needed if using OIDC to get release secrets. |
12 | | - contents: write # Contents and pull-requests are for release-please to make releases. |
13 | | - pull-requests: write |
| 38 | + contents: write # Needed for release-please to create releases. |
| 39 | + pull-requests: write # Needed for release-please to create/update PRs. |
| 40 | + if: github.event_name == 'push' |
14 | 41 | outputs: |
15 | | - release-created: ${{ steps.release.outputs.release_created }} |
16 | | - upload-tag-name: ${{ steps.release.outputs.tag_name }} |
17 | | - package-hashes: ${{ steps.build.outputs.package-hashes}} |
| 42 | + package-server-ai-released: ${{ steps.release.outputs['packages/sdk/server-ai--release_created'] }} |
| 43 | + package-server-ai-tag-name: ${{ steps.release.outputs['packages/sdk/server-ai--tag_name'] }} |
| 44 | + package-server-ai-langchain-released: ${{ steps.release.outputs['packages/ai-providers/server-ai-langchain--release_created'] }} |
| 45 | + package-server-ai-langchain-tag-name: ${{ steps.release.outputs['packages/ai-providers/server-ai-langchain--tag_name'] }} |
18 | 46 | steps: |
19 | 47 | - uses: googleapis/release-please-action@v4 |
20 | 48 | id: release |
21 | 49 |
|
| 50 | + release-server-ai: |
| 51 | + runs-on: ubuntu-latest |
| 52 | + needs: ['release-please'] |
| 53 | + permissions: |
| 54 | + id-token: write # Needed for OIDC to get release secrets from AWS. |
| 55 | + if: ${{ needs.release-please.outputs.package-server-ai-released == 'true' }} |
| 56 | + outputs: |
| 57 | + package-hashes: ${{ steps.build.outputs.package-hashes }} |
| 58 | + steps: |
22 | 59 | - uses: actions/checkout@v4 |
23 | | - if: ${{ steps.release.outputs.releases_created == 'true' }} |
24 | 60 | with: |
25 | | - fetch-depth: 0 # If you only need the current version keep this. |
| 61 | + fetch-depth: 0 |
26 | 62 |
|
27 | 63 | - uses: actions/setup-python@v5 |
28 | | - if: ${{ steps.release.outputs.releases_created == 'true' }} |
29 | 64 | with: |
30 | | - python-version: 3.9 |
| 65 | + python-version: '3.11' |
31 | 66 |
|
32 | 67 | - name: Install poetry |
33 | | - if: ${{ steps.release.outputs.releases_created == 'true' }} |
34 | 68 | uses: abatilo/actions-poetry@7b6d33e44b4f08d7021a1dee3c044e9c253d6439 |
35 | 69 |
|
| 70 | + - uses: ./.github/actions/ci |
| 71 | + with: |
| 72 | + workspace_path: packages/sdk/server-ai |
| 73 | + |
| 74 | + - uses: ./.github/actions/build |
| 75 | + id: build |
| 76 | + with: |
| 77 | + workspace_path: packages/sdk/server-ai |
| 78 | + |
36 | 79 | - uses: launchdarkly/gh-actions/actions/[email protected] |
37 | | - if: ${{ steps.release.outputs.releases_created == 'true' }} |
38 | 80 | name: 'Get PyPI token' |
39 | 81 | with: |
40 | 82 | aws_assume_role: ${{ vars.AWS_ROLE_ARN }} |
41 | 83 | ssm_parameter_pairs: '/production/common/releasing/pypi/token = PYPI_AUTH_TOKEN' |
42 | 84 |
|
| 85 | + - name: Publish to PyPI |
| 86 | + uses: pypa/gh-action-pypi-publish@release/v1 |
| 87 | + with: |
| 88 | + password: ${{ env.PYPI_AUTH_TOKEN }} |
| 89 | + packages-dir: packages/sdk/server-ai/dist/ |
| 90 | + |
| 91 | + release-server-ai-langchain: |
| 92 | + runs-on: ubuntu-latest |
| 93 | + needs: ['release-please'] |
| 94 | + permissions: |
| 95 | + id-token: write # Needed for OIDC to get release secrets from AWS. |
| 96 | + if: ${{ needs.release-please.outputs.package-server-ai-langchain-released == 'true' }} |
| 97 | + outputs: |
| 98 | + package-hashes: ${{ steps.build.outputs.package-hashes }} |
| 99 | + steps: |
| 100 | + - uses: actions/checkout@v4 |
| 101 | + with: |
| 102 | + fetch-depth: 0 |
| 103 | + |
| 104 | + - uses: actions/setup-python@v5 |
| 105 | + with: |
| 106 | + python-version: '3.11' |
| 107 | + |
| 108 | + - name: Install poetry |
| 109 | + uses: abatilo/actions-poetry@7b6d33e44b4f08d7021a1dee3c044e9c253d6439 |
| 110 | + |
| 111 | + - uses: ./.github/actions/ci |
| 112 | + with: |
| 113 | + workspace_path: packages/ai-providers/server-ai-langchain |
| 114 | + |
43 | 115 | - uses: ./.github/actions/build |
44 | 116 | id: build |
45 | | - if: ${{ steps.release.outputs.releases_created == 'true' }} |
| 117 | + with: |
| 118 | + workspace_path: packages/ai-providers/server-ai-langchain |
46 | 119 |
|
47 | | - - uses: ./.github/actions/build-docs |
48 | | - if: ${{ steps.release.outputs.releases_created == 'true' }} |
| 120 | + - uses: launchdarkly/gh-actions/actions/[email protected] |
| 121 | + name: 'Get PyPI token' |
| 122 | + with: |
| 123 | + aws_assume_role: ${{ vars.AWS_ROLE_ARN }} |
| 124 | + ssm_parameter_pairs: '/production/common/releasing/pypi/token = PYPI_AUTH_TOKEN' |
49 | 125 |
|
50 | | - - name: Publish package distributions to PyPI |
51 | | - if: ${{ steps.release.outputs.releases_created == 'true' }} |
52 | | - uses: pypa/gh-action-pypi-publish@release/v1 |
| 126 | + - name: Publish to PyPI |
| 127 | + # Pin the action to a full 40-character commit SHA for security. |
| 128 | + # Release v1 commit SHA as of 2024-06-14: |
| 129 | + # https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.13 |
| 130 | + # Commit SHA: 19af04270e8d898ea07a523bb392fa7fe98df87c |
| 131 | + uses: pypa/gh-action-pypi-publish@19af04270e8d898ea07a523bb392fa7fe98df87c |
| 132 | + with: |
| 133 | + password: ${{ env.PYPI_AUTH_TOKEN }} |
| 134 | + packages-dir: packages/ai-providers/server-ai-langchain/dist/ |
| 135 | + |
| 136 | + manual-publish: |
| 137 | + runs-on: ubuntu-latest |
| 138 | + if: github.event_name == 'workflow_dispatch' |
| 139 | + permissions: |
| 140 | + id-token: write # Needed for OIDC to get release secrets from AWS. |
| 141 | + contents: read # Needed for actions/checkout. |
| 142 | + steps: |
| 143 | + - uses: actions/checkout@v4 |
| 144 | + |
| 145 | + - uses: actions/setup-python@v5 |
| 146 | + with: |
| 147 | + python-version: '3.11' |
| 148 | + |
| 149 | + - name: Install poetry |
| 150 | + uses: abatilo/actions-poetry@7b6d33e44b4f08d7021a1dee3c044e9c253d6439 |
| 151 | + |
| 152 | + - uses: ./.github/actions/ci |
| 153 | + with: |
| 154 | + workspace_path: ${{ inputs.workspace_path }} |
| 155 | + |
| 156 | + - uses: ./.github/actions/build |
| 157 | + id: build |
| 158 | + with: |
| 159 | + workspace_path: ${{ inputs.workspace_path }} |
| 160 | + |
| 161 | + - uses: launchdarkly/gh-actions/actions/[email protected] |
| 162 | + if: ${{ inputs.dry_run != true }} |
| 163 | + name: 'Get PyPI token' |
| 164 | + with: |
| 165 | + aws_assume_role: ${{ vars.AWS_ROLE_ARN }} |
| 166 | + ssm_parameter_pairs: '/production/common/releasing/pypi/token = PYPI_AUTH_TOKEN' |
| 167 | + |
| 168 | + - name: Publish to PyPI |
| 169 | + if: ${{ inputs.dry_run != true }} |
| 170 | + # https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.13 - pinned to commit on 2024-04-13 |
| 171 | + uses: pypa/gh-action-pypi-publish@3cc2c35166dfc1e5ea3bb0491ffdeedcaa50d7c |
53 | 172 | with: |
54 | | - password: ${{env.PYPI_AUTH_TOKEN}} |
| 173 | + password: ${{ env.PYPI_AUTH_TOKEN }} |
| 174 | + packages-dir: ${{ inputs.workspace_path }}/dist/ |
| 175 | + |
| 176 | + release-server-ai-provenance: |
| 177 | + needs: ['release-please', 'release-server-ai'] |
| 178 | + if: ${{ needs.release-please.outputs.package-server-ai-released == 'true' }} |
| 179 | + permissions: |
| 180 | + actions: read # Needed for detecting the GitHub Actions environment. |
| 181 | + id-token: write # Needed for provenance signing. |
| 182 | + contents: write # Needed for uploading assets to the release. |
| 183 | + uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] |
| 184 | + with: |
| 185 | + base64-subjects: "${{ needs.release-server-ai.outputs.package-hashes }}" |
| 186 | + upload-assets: true |
| 187 | + upload-tag-name: ${{ needs.release-please.outputs.package-server-ai-tag-name }} |
55 | 188 |
|
56 | | - release-provenance: |
57 | | - needs: [ 'release-package' ] |
58 | | - if: ${{ needs.release-package.outputs.release-created == 'true' }} |
| 189 | + release-server-ai-langchain-provenance: |
| 190 | + needs: ['release-please', 'release-server-ai-langchain'] |
| 191 | + if: ${{ needs.release-please.outputs.package-server-ai-langchain-released == 'true' }} |
59 | 192 | permissions: |
60 | | - actions: read |
61 | | - id-token: write |
62 | | - contents: write |
| 193 | + actions: read # Needed for detecting the GitHub Actions environment. |
| 194 | + id-token: write # Needed for provenance signing. |
| 195 | + contents: write # Needed for uploading assets to the release. |
63 | 196 | uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] |
64 | 197 | with: |
65 | | - base64-subjects: "${{ needs.release-package.outputs.package-hashes }}" |
| 198 | + base64-subjects: "${{ needs.release-server-ai-langchain.outputs.package-hashes }}" |
66 | 199 | upload-assets: true |
67 | | - upload-tag-name: ${{ needs.release-package.outputs.upload-tag-name }} |
| 200 | + upload-tag-name: ${{ needs.release-please.outputs.package-server-ai-langchain-tag-name }} |
0 commit comments