|
5 | 5 | branches: [main] |
6 | 6 |
|
7 | 7 | jobs: |
8 | | - release-please: |
9 | | - runs-on: ubuntu-latest |
10 | | - permissions: |
11 | | - contents: write |
12 | | - pull-requests: write |
13 | | - outputs: |
14 | | - releases_created: ${{ steps.release.outputs.releases_created }} |
15 | | - steps: |
16 | | - # Create any releases first, then create tags, and then optionally create any new PRs. |
17 | | - - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0 |
18 | | - id: release |
19 | | - with: |
20 | | - skip-github-pull-request: true |
21 | | - |
22 | | - # Need the repository content to be able to create and push a tag. |
23 | | - - uses: actions/checkout@v4 |
24 | | - if: ${{ steps.release.outputs.release_created == 'true' }} |
25 | | - |
26 | | - - name: Create release tag |
27 | | - if: ${{ steps.release.outputs.release_created == 'true' }} |
28 | | - env: |
29 | | - TAG_NAME: ${{ steps.release.outputs.tag_name }} |
30 | | - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
31 | | - run: | |
32 | | - if gh api "repos/${{ github.repository }}/git/ref/tags/${TAG_NAME}" >/dev/null 2>&1; then |
33 | | - echo "Tag ${TAG_NAME} already exists, skipping creation." |
34 | | - else |
35 | | - echo "Creating tag ${TAG_NAME}." |
36 | | - git config user.name "github-actions[bot]" |
37 | | - git config user.email "github-actions[bot]@users.noreply.github.com" |
38 | | - git tag "${TAG_NAME}" |
39 | | - git push origin "${TAG_NAME}" |
40 | | - fi |
41 | | -
|
42 | | - - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0 |
43 | | - if: ${{ steps.release.outputs.release_created != 'true' }} |
44 | | - id: release-prs |
45 | | - with: |
46 | | - skip-github-release: true |
47 | | - |
48 | 8 | release-package: |
49 | | - needs: release-please |
50 | | - if: ${{ needs.release-please.outputs.releases_created == 'true' }} |
51 | 9 | runs-on: ubuntu-latest |
52 | 10 | permissions: |
53 | 11 | id-token: write # Needed if using OIDC to get release secrets. |
54 | 12 | contents: write # Contents and pull-requests are for release-please to make releases. |
| 13 | + pull-requests: write |
55 | 14 | attestations: write # Needed for artifact attestations |
56 | 15 | steps: |
| 16 | + - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0 |
| 17 | + id: release |
| 18 | + |
57 | 19 | - uses: actions/checkout@v4 |
| 20 | + if: ${{ steps.release.outputs.releases_created == 'true' }} |
58 | 21 | with: |
59 | 22 | fetch-depth: 0 |
60 | 23 |
|
61 | 24 | - uses: actions/setup-python@v5 |
| 25 | + if: ${{ steps.release.outputs.releases_created == 'true' }} |
62 | 26 | with: |
63 | 27 | python-version: "3.10" |
64 | 28 |
|
65 | 29 | - name: Install poetry |
| 30 | + if: ${{ steps.release.outputs.releases_created == 'true' }} |
66 | 31 | uses: abatilo/actions-poetry@7b6d33e44b4f08d7021a1dee3c044e9c253d6439 # v3.0.0 |
67 | 32 |
|
68 | 33 | - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0 |
| 34 | + if: ${{ steps.release.outputs.releases_created == 'true' }} |
69 | 35 | name: "Get PyPI token" |
70 | 36 | with: |
71 | 37 | aws_assume_role: ${{ vars.AWS_ROLE_ARN }} |
72 | 38 | ssm_parameter_pairs: "/production/common/releasing/pypi/token = PYPI_AUTH_TOKEN" |
73 | 39 |
|
74 | 40 | - uses: ./.github/actions/build |
75 | 41 | id: build |
| 42 | + if: ${{ steps.release.outputs.releases_created == 'true' }} |
76 | 43 |
|
77 | 44 | - uses: ./.github/actions/build-docs |
| 45 | + if: ${{ steps.release.outputs.releases_created == 'true' }} |
78 | 46 |
|
79 | 47 | - name: Publish package distributions to PyPI |
| 48 | + if: ${{ steps.release.outputs.releases_created == 'true' }} |
80 | 49 | uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 |
81 | 50 | with: |
82 | 51 | password: ${{env.PYPI_AUTH_TOKEN}} |
83 | 52 |
|
84 | 53 | - name: Attest build provenance |
| 54 | + if: ${{ steps.release.outputs.releases_created == 'true' }} |
85 | 55 | uses: actions/attest@v4 |
86 | 56 | with: |
87 | 57 | subject-path: 'dist/*' |
0 commit comments