build-test-release.yaml

---
# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: 2025 The Linux Foundation

# Runs on a new pull request, performs build and runs tests
name: 'Python Build/Test/Release'

# yamllint disable-line rule:truthy
on:
  # Trigger on tag push events
  push:
    tags:
      - '**'

permissions: {}

jobs:
  repository:
    name: 'Repository'
    # yamllint disable-line rule:line-length
    uses: os-climate/osc-github-devops/.github/workflows/reuse-inspect-repository.yaml@50a55963fb815139987f49c15f7380eb5d028974 # Pre v0.1.30
    permissions:
      contents: read

  tag-validate:
    name: 'Validate tag push'
    needs: repository
    runs-on: 'ubuntu-24.04'
    permissions:
      contents: read
    timeout-minutes: 1
    outputs:
      tag: "${{ steps.tag-validate.outputs.tag }}"
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - name: 'Verify Pushed Tag'
        id: tag-validate
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/tag-push-verify-action@f9c6e753870c6405883be2ba18af05d075aaffe8 # v0.1.0
        with:
          versioning: 'semver'

  dynamic-version-check:
    name: 'Dynamic Version Check'
    runs-on: ubuntu-24.04
    needs: repository
    if: needs.repository.outputs.python_project == 'true'
    outputs:
      dynamic_version: ${{ steps.dynamic-version.outputs.dynamic_version }}
    permissions:
      contents: read
    timeout-minutes: 1
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: 'Check for dynamic versioning'
        id: dynamic-version
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/python-dynamic-version-action@757278a7dce3add2c777305e7ec61d9e2b97ed7e # v0.1.6

  python-build:
    name: 'Python Build'
    needs:
      - repository
      - tag-validate
      - dynamic-version-check
    if: needs.repository.outputs.python_project  == 'true'
    runs-on: 'ubuntu-24.04'
    outputs:
      matrix_json: "${{ steps.python-build.outputs.matrix_json }}"
      artefact_name: "${{ steps.python-build.outputs.artefact_name }}"
      artefact_path: "${{ steps.python-build.outputs.artefact_path }}"
    permissions:
      contents: write
      id-token: write       # Needed for attestations
      attestations: write   # Needed for attestations
    timeout-minutes: 12
    env:
      GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: 'Build Python project'
        id: python-build
        # yamllint disable-line rule:line-length
        uses: modeseven-lfreleng-actions/python-build-action@build-requirements-fix # Testing
        # yamllint disable-line rule:line-length
        # uses: lfreleng-actions/python-build-action@56dd541a74b5cf9f0c5939ed98387478824720a2 # v0.1.8
        with:
          # Only pass tag if NOT using dynamic versioning
          # yamllint disable-line rule:line-length
          tag: ${{ needs.dynamic-version-check.outputs.dynamic_version == 'true' && '' || needs.tag-validate.outputs.tag }}
          # Skip version patching when using dynamic versioning
          skip_version_patch: ${{ needs.dynamic-version-check.outputs.dynamic_version == 'true' }}
          sigstore_sign: true
          attestations: true

  python-tests:
    name: 'Python Tests'
    runs-on: 'ubuntu-24.04'
    needs:
      - python-build
    # Matrix job
    strategy:
      fail-fast: false
      matrix: "${{ fromJson(needs.python-build.outputs.matrix_json) }}"
    permissions:
      contents: read
    timeout-minutes: 12
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: 'Test Python project [PYTEST]'
        # yamllint disable-line rule:line-length
        uses: modeseven-lfreleng-actions/python-test-action@update-action # Testing
        # yamllint disable-line rule:line-length
        # uses: lfreleng-actions/python-test-action@b06828bf94ae4beef00d49cddc06839eca2d8f05 # v0.1.6
        with:
          python_version: "${{ matrix.python-version }}"

  python-audit:
    name: 'Python Audit'
    runs-on: 'ubuntu-24.04'
    needs:
      - python-build
    # Matrix job
    strategy:
      fail-fast: false
      matrix: "${{ fromJson(needs.python-build.outputs.matrix_json) }}"
    permissions:
      contents: read
    timeout-minutes: 10
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: 'Audit Python project'
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/python-audit-action@4c51bc76f9876b4f294f8afa4bb002b0b89aec68 # v0.1.3
        with:
          python_version: "${{ matrix.python-version }}"

  notebooks:
    name: 'Test Jupyter Notebooks'
    runs-on: 'ubuntu-24.04'
    if: needs.repository.outputs.jupyter_notebooks  == 'true'
    needs:
      - repository
      - python-build
    # Matrix job
    strategy:
      fail-fast: false
      matrix: "${{ fromJson(needs.python-build.outputs.matrix_json) }}"
    permissions:
      contents: read
    timeout-minutes: 10
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      # yamllint disable-line rule:line-length
      - uses: lfreleng-actions/python-notebook-test-action@471123b59d0ef608f95bece4d36a95ebabab0a68 # v0.1.1
        with:
          python_version: "${{ matrix.python-version }}"

  test-pypi:
    name: 'Test PyPI Publishing'
    runs-on: 'ubuntu-24.04'
    needs:
      - tag-validate
      - repository
      - python-tests
      - python-audit
      - notebooks
    environment:
      name: development
    permissions:
      contents: read
      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
    timeout-minutes: 5
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: 'Test PyPI publishing'
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/pypi-publish-action@81a056957ed050f8305760055b1fd8103a916989 # v0.1.1
        with:
          environment: 'development'
          tag: "${{ needs.tag-validate.outputs.tag }}"

  pypi:
    name: 'Release PyPI Package'
    runs-on: 'ubuntu-24.04'
    needs:
      - tag-validate
      - test-pypi
    environment:
      name: production
    permissions:
      contents: read
      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
    timeout-minutes: 5
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: 'PyPI release'
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/pypi-publish-action@81a056957ed050f8305760055b1fd8103a916989 # v0.1.1
        with:
          environment: 'production'
          attestations: true
          tag: "${{ needs.tag-validate.outputs.tag }}"

  promote-release:
    name: 'Promote Draft Release'
    # yamllint disable-line rule:line-length
    if: startsWith(github.ref, 'refs/tags/')
    needs:
      - tag-validate
      - pypi
    runs-on: 'ubuntu-24.04'
    permissions:
      contents: write
      # id-token: write
    timeout-minutes: 2
    outputs:
      release_url: "${{ steps.promote-release.outputs.release_url }}"
    steps:
      # Harden the runner used by this workflow
      # yamllint disable-line rule:line-length
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      # yamllint disable-line rule:line-length
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: 'Promote draft release'
        id: promote-release
        # yamllint disable-line rule:line-length
        uses: modeseven-lfreleng-actions/draft-release-promote-action@output-release-url # Testing
        # yamllint disable-line rule:line-length
        # uses: lfreleng-actions/draft-release-promote-action@0392844e1e08a0539b63ba1940a7a2bfa2bda077 # v0.1.1
        with:
          token: "${{ secrets.GITHUB_TOKEN }}"
          tag: "${{ needs.tag-validate.outputs.tag }}"
          latest: true

  # Need to attach build artefacts to the release
  # This step could potentially be moved
  # (May be better to when/where the release is still in draft state)
  attach-artefacts:
    name: 'Attach Artefacts to Release'
    runs-on: 'ubuntu-24.04'
    needs:
      - tag-validate
      - python-build
      - promote-release
    permissions:
      contents: write
    timeout-minutes: 5
    steps:
      # Harden the runner used by this workflow
      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      # Note: should not need a checkout step

      - name: 'Attach artefacts to release'
        # yamllint disable-line rule:line-length
        uses: modeseven-lfreleng-actions/release-attach-artefacts-action@initial-update # Testing
        with:
          # Probably only need one of these in the implementation; decide later
          tag: "${{ needs.tag-validate.outputs.tag }}"
          release_url: "${{ needs.promote-release.outputs.release_url }}"
          artefact_name: "${{ needs.python-build.outputs.artefact_name }}"
          artefact_path: "${{ needs.python-build.outputs.artefact_path }}"