|
1 | 1 | name: Release |
2 | 2 |
|
| 3 | +# Runs every CI gate, then tags the commit and cuts a GitHub release with both |
| 4 | +# single-file distributables attached as assets. |
| 5 | +# |
| 6 | +# The version is whatever `pyproject.toml` says — bump it on main first (along |
| 7 | +# with the other three places `scripts/check_version.py` checks), then dispatch |
| 8 | +# this workflow. `dry_run` (on by default) runs every gate and touches neither |
| 9 | +# the repo nor any release, so a rehearsal is free. |
| 10 | +# |
| 11 | +# There is no PyPI publish: these plugins are distributed as single files via the |
| 12 | +# Open WebUI community hub and as GitHub Release assets, not as a pip package. |
| 13 | +# The release itself is therefore the artifact, and creating it is the last step. |
| 14 | + |
3 | 15 | on: |
4 | | - release: |
5 | | - types: [published] |
6 | 16 | workflow_dispatch: |
7 | 17 | inputs: |
8 | | - tag: |
9 | | - description: "Release tag to validate against (e.g. v0.1.0)" |
10 | | - required: true |
| 18 | + dry_run: |
| 19 | + description: Run checks without tagging or creating the release |
| 20 | + type: boolean |
| 21 | + default: true |
| 22 | + |
| 23 | +permissions: |
| 24 | + contents: write # pushes the version tag and creates the release |
| 25 | + |
| 26 | +concurrency: |
| 27 | + group: release-${{ github.ref }} |
| 28 | + cancel-in-progress: false |
11 | 29 |
|
12 | | -# No PyPI publish: these plugins are distributed as single files via the Open |
13 | | -# WebUI community hub and as GitHub Release assets, not as a pip package. |
14 | 30 | jobs: |
15 | | - release-assets: |
| 31 | + release: |
16 | 32 | runs-on: ubuntu-latest |
17 | | - permissions: |
18 | | - contents: write |
19 | 33 | steps: |
20 | | - - uses: actions/checkout@v4 |
21 | | - - uses: actions/setup-python@v5 |
| 34 | + - name: Checkout |
| 35 | + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 |
| 36 | + with: |
| 37 | + # Tags are needed to tell "already released" from "tag collision". |
| 38 | + fetch-depth: 0 |
| 39 | + |
| 40 | + - name: Setup Python |
| 41 | + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 |
22 | 42 | with: |
23 | 43 | python-version: "3.12" |
24 | | - - run: pip install -e ".[dev]" |
| 44 | + |
| 45 | + # The version about to be released must be documented. First gate, before |
| 46 | + # anything is installed: a release whose version isn't in the changelog is |
| 47 | + # a release we'd have to redo. |
| 48 | + - name: Check the changelog covers this version |
| 49 | + run: python scripts/check_changelog.py |
| 50 | + |
| 51 | + - name: Install dependencies |
| 52 | + run: pip install -e ".[dev]" |
| 53 | + |
| 54 | + # The same gates as CI, so a release can never ship something CI would have |
| 55 | + # rejected — including build-sync, which asserts the committed single-file |
| 56 | + # distributables still match the source they're generated from. |
| 57 | + |
| 58 | + - name: Lint |
| 59 | + run: ruff check src scripts tests |
| 60 | + |
| 61 | + - name: Check formatting |
| 62 | + run: ruff format --check src scripts tests |
| 63 | + |
| 64 | + - name: Test |
| 65 | + run: pytest tests/unit -q |
| 66 | + |
| 67 | + - name: Audit dependencies for known vulnerabilities |
| 68 | + run: | |
| 69 | + pip install pip-audit |
| 70 | + pip-audit . |
25 | 71 |
|
26 | 72 | - name: Build distributables |
27 | 73 | run: python scripts/build.py |
28 | 74 |
|
29 | 75 | - name: Assert committed distributables are in sync |
30 | 76 | run: git diff --exit-code open-webui/ |
31 | 77 |
|
32 | | - - name: Assert version matches the release tag |
| 78 | + # Notes come from the changelog rather than --generate-notes, so the release |
| 79 | + # reads as something written for operators instead of a commit list. This |
| 80 | + # also rejects an empty section, which check_changelog.py accepts. |
| 81 | + - name: Extract release notes from the changelog |
| 82 | + run: python scripts/changelog_notes.py | tee "${RUNNER_TEMP}/notes.md" |
| 83 | + |
| 84 | + - name: Resolve version |
| 85 | + id: version |
| 86 | + run: | |
| 87 | + set -euo pipefail |
| 88 | + VERSION="$(python -c 'import re,pathlib; print(re.search(r"^version\s*=\s*\"([^\"]+)\"", pathlib.Path("pyproject.toml").read_text(), re.M).group(1))')" |
| 89 | + echo "version=${VERSION}" >> "$GITHUB_OUTPUT" |
| 90 | + echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT" |
| 91 | +
|
| 92 | + - name: Assert every declared version agrees with the tag |
| 93 | + run: python scripts/check_version.py "${{ steps.version.outputs.tag }}" |
| 94 | + |
| 95 | + # Fail before tagging rather than after: a tag on some other commit means |
| 96 | + # the version was not bumped. |
| 97 | + - name: Check the version tag is free |
| 98 | + env: |
| 99 | + TAG: ${{ steps.version.outputs.tag }} |
33 | 100 | run: | |
34 | | - TAG="${{ github.event.release.tag_name || github.event.inputs.tag }}" |
35 | | - python scripts/check_version.py "$TAG" |
| 101 | + set -euo pipefail |
| 102 | + if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then |
| 103 | + if [ "$(git rev-list -n1 "${TAG}")" != "${GITHUB_SHA}" ]; then |
| 104 | + echo "${TAG} already exists and points at a different commit — bump the version" >&2 |
| 105 | + exit 1 |
| 106 | + fi |
| 107 | + echo "${TAG} already points at this commit" |
| 108 | + fi |
36 | 109 |
|
37 | | - - name: Upload distributables as release assets |
38 | | - if: github.event_name == 'release' |
| 110 | + - name: Tag the release |
39 | 111 | env: |
| 112 | + DRY_RUN: ${{ inputs.dry_run }} |
| 113 | + TAG: ${{ steps.version.outputs.tag }} |
| 114 | + run: | |
| 115 | + set -euo pipefail |
| 116 | +
|
| 117 | + if [ "${DRY_RUN}" = "true" ]; then |
| 118 | + echo "dry run: would tag ${GITHUB_SHA} as ${TAG}" |
| 119 | + exit 0 |
| 120 | + fi |
| 121 | +
|
| 122 | + if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then |
| 123 | + echo "${TAG} already exists, leaving it alone" |
| 124 | + exit 0 |
| 125 | + fi |
| 126 | +
|
| 127 | + git -c user.name='github-actions[bot]' \ |
| 128 | + -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \ |
| 129 | + tag -a "${TAG}" -m "${TAG}" |
| 130 | + git push origin "${TAG}" |
| 131 | +
|
| 132 | + # Creating the release comes last, so a failed gate leaves no tag and no |
| 133 | + # release behind. The reverse gap — tagged but no release — is recoverable: |
| 134 | + # this step is idempotent, so re-running the workflow finishes the job. |
| 135 | + - name: Create the GitHub release |
| 136 | + env: |
| 137 | + DRY_RUN: ${{ inputs.dry_run }} |
40 | 138 | GH_TOKEN: ${{ github.token }} |
| 139 | + TAG: ${{ steps.version.outputs.tag }} |
41 | 140 | run: | |
42 | | - gh release upload "${{ github.event.release.tag_name }}" \ |
43 | | - open-webui/tools/tenki_code_execution.py \ |
44 | | - open-webui/functions/tenki_run_code.py \ |
45 | | - --clobber |
| 141 | + set -euo pipefail |
| 142 | +
|
| 143 | + ASSETS=( |
| 144 | + open-webui/tools/tenki_code_execution.py |
| 145 | + open-webui/functions/tenki_run_code.py |
| 146 | + ) |
| 147 | +
|
| 148 | + if [ "${DRY_RUN}" = "true" ]; then |
| 149 | + echo "dry run: would create release ${TAG} with assets: ${ASSETS[*]}" |
| 150 | + exit 0 |
| 151 | + fi |
| 152 | +
|
| 153 | + # Assets are refreshed but existing notes are left alone, in case they |
| 154 | + # were edited by hand after the release was cut. |
| 155 | + if gh release view "${TAG}" >/dev/null 2>&1; then |
| 156 | + echo "release ${TAG} already exists, refreshing its assets" |
| 157 | + gh release upload "${TAG}" "${ASSETS[@]}" --clobber |
| 158 | + exit 0 |
| 159 | + fi |
| 160 | +
|
| 161 | + gh release create "${TAG}" \ |
| 162 | + --title "${TAG}" \ |
| 163 | + --notes-file "${RUNNER_TEMP}/notes.md" \ |
| 164 | + --verify-tag \ |
| 165 | + "${ASSETS[@]}" |
0 commit comments