Add approver requirement for the release; simplify code release (#2896)

* Requires an approver to start a release.
* Update release_code to only push a tag; code pushing is not needed due
to mirroring.

Author: kory

.github/workflows/release.yaml

@@ -24,16 +24,27 @@ jobs:
       models: none # only enable unit tests
       use_public_wheel: true
 
+  approve:
+    name: Approve Release
+    if: ${{ inputs.target == 'prod' }}
+    needs: [test_public_wheel]
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: release
+    steps:
+      - run: echo "Release approved"
+
   release_code:
       name: Release code to Repository
       secrets: inherit
-      needs: [test_public_wheel]
+      needs: [approve]
       uses: ./.github/workflows/release_code.yaml
 
   release_pypi:
       name: Release wheel to ${{ inputs.target == 'prod' && 'PyPi' || 'test PyPi' }}
       secrets: inherit
-      needs: [test_public_wheel]
+      needs: [approve]
+      if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
       uses: ./.github/workflows/release_pypi.yaml
       with:
           target: ${{ inputs.target }}
@@ -42,21 +53,21 @@ jobs:
       name: Release Hugging Face Model Cards
       if: ${{ inputs.target == 'prod' }}
       secrets: inherit
-      needs: [test_public_wheel]
+      needs: [approve]
       uses: ./.github/workflows/release_huggingface.yaml
 
   release_assets:
       name: Release Assets
       if: ${{ inputs.target == 'prod' }}
       secrets: inherit
-      needs: [test_public_wheel]
+      needs: [approve]
       uses: ./.github/workflows/release_assets.yaml
 
   sync_public_website:
     name: Sync Public Website & Create Public Website PR
     secrets: inherit
     if: ${{ inputs.target == 'prod' }}
-    needs: [test_public_wheel]
+    needs: [approve]
     uses: ./.github/workflows/release_website.yml
     with:
       source_branch_name: ${{ github.ref }}

.github/workflows/release_assets.yaml

@@ -11,8 +11,19 @@ env:
   VENV_PATH: build/ci-envs/release
 
 jobs:
+  approve:
+    if: github.event_name == 'workflow_dispatch'
+    name: Approve Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: release
+    steps:
+      - run: echo "Release approved"
+
   release_assets:
       name: Release - Assets
+      needs: [approve]
+      if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
       runs-on: [tetra-ubuntu-2204, self-hosted]
       permissions:
         id-token: write # Required for OIDC auth to AWS

.github/workflows/release_code.yaml

@@ -13,8 +13,19 @@ on:
   workflow_call:
 
 jobs:
+  approve:
+    if: github.event_name == 'workflow_dispatch'
+    name: Approve Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: release
+    steps:
+      - run: echo "Release approved"
+
   release_code_repo:
       name: Release Code
+      needs: [approve]
+      if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
       runs-on: [tetra-ubuntu-2204, self-hosted]
 
       steps:
@@ -27,14 +38,13 @@ jobs:
 
       - uses: actions/checkout@v6
 
-      - name: Push to public repository
+      - name: Push tag to public repository
         env:
           QAIHM_TAG: ${{ github.ref_name }}
           GH_TOKEN: ${{ secrets.PROD_GH_TOKEN }}
         run: |
           git config --local credential.helper '!f() { echo "username=x-access-token"; echo "password=$GH_TOKEN"; }; f'
           git remote add public https://github.com/qualcomm/ai-hub-models.git
-          git fetch public main --depth=1
 
           FORCE_FLAG=""
           if [ "${{ inputs.force }}" == "true" ]; then
@@ -46,14 +56,5 @@ jobs:
             fi
           fi
 
-          # Squash all changes into a single commit on top of public main
-          git reset public/main
-          git add -A
-          git commit -m "$QAIHM_TAG
-
-          See https://github.com/qualcomm/ai-hub-models/releases/$QAIHM_TAG for changelog.
-
-          Signed-off-by: The AI Hub Models Team <ai-hub-support@qti.qualcomm.com>"
-
           git tag -a $FORCE_FLAG "$QAIHM_TAG" -m "$QAIHM_TAG"
           git push $FORCE_FLAG public "$QAIHM_TAG"

.github/workflows/release_huggingface.yaml

@@ -18,8 +18,19 @@ on:
             description: (Optional) Commit Message
 
 jobs:
+  approve:
+    if: github.event_name == 'workflow_dispatch'
+    name: Approve Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: release
+    steps:
+      - run: echo "Release approved"
+
   release_huggingface:
       name: Release HuggingFace Model Cards
+      needs: [approve]
+      if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
       runs-on: [tetra-ubuntu-2204, self-hosted]
       env:
         QAIHM_CI: "true"

.github/workflows/release_pypi.yaml

@@ -25,8 +25,19 @@ env:
   VENV_PATH: build/ci-envs/release
 
 jobs:
+  approve:
+    if: github.event_name == 'workflow_dispatch' && inputs.target == 'prod'
+    name: Approve Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: release
+    steps:
+      - run: echo "Release approved"
+
   release_pypi:
       name: Release to ${{ inputs.target == 'prod' && 'PyPI' || 'test PyPI' }}
+      needs: [approve]
+      if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
       runs-on: [tetra-ubuntu-2204, self-hosted]
 
       steps: