airlock/.github/workflows/release.yml at 6e8fb901ba9227c8626d234a72921e90002fcd6f · coreyt/airlock · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
# Publish to PyPI when a version tag is pushed.
#
# Usage:
#   1. Bump version in pyproject.toml
#   2. Commit: git commit -am "Release 0.2.0"
#   3. Tag:    git tag v0.2.0
#   4. Push:   git push origin main --tags
#
# The workflow builds the package, runs tests, and publishes to PyPI
# using trusted publishing (no API tokens needed — configure the
# trusted publisher in PyPI project settings).
#
# PyPI trusted publisher setup (one-time):
#   Go to https://pypi.org/manage/project/airlock-llm/settings/publishing/
#   Add a new publisher:
#     - Owner: coreyt
#     - Repository: airlock
#     - Workflow: release.yml
#     - Environment: pypi

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write   # create GitHub release
  id-token: write   # PyPI trusted publishing (OIDC)

jobs:
  # Gate: run the full test suite before publishing
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.12"]

    steps:
      - uses: actions/checkout@v6

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install uv
        uses: astral-sh/setup-uv@v8.0.0

      - name: Install dependencies
        run: uv sync --locked --all-extras

      - name: Download spaCy model
        run: make ensure-spacy

      - name: Run tests
        run: uv run pytest --tb=short -q -m "not live"

      - name: Build strict documentation site
        run: uv run mkdocs build --strict --site-dir /tmp/airlock-docs

  # Gate: verify the tag version matches pyproject.toml
  check-version:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Verify tag matches pyproject.toml version
        run: |
          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
          PKG_VERSION=$(python -c "
          import tomllib
          with open('pyproject.toml', 'rb') as f:
              print(tomllib.load(f)['project']['version'])
          ")
          echo "Tag version:     $TAG_VERSION"
          echo "Package version: $PKG_VERSION"
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Tag v$TAG_VERSION does not match pyproject.toml version $PKG_VERSION"
            exit 1
          fi

  # Build sdist and wheel
  build:
    needs: [test, check-version]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install uv
        uses: astral-sh/setup-uv@v8.0.0

      - name: Build package
        run: |
          uv lock --check
          uv build

      - name: Upload dist artifacts
        uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/

  # Publish to PyPI via trusted publishing
  publish:
    needs: [build]
    runs-on: ubuntu-latest
    environment: pypi
    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  # Create a GitHub release with the built artifacts
  github-release:
    needs: [publish]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Download dist artifacts
        uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.version.outputs.version }}
          name: ${{ steps.version.outputs.version }}
          generate_release_notes: true
          files: dist/*