Skip to content

Commit c11f3e5

Browse files
eyurtseveyurtsev
committed
Update _release.yml
1 parent d3dbe18 commit c11f3e5

25 files changed

+1784
-4144
lines changed

‎.github/actions/poetry_setup/action.yml‎

Lines changed: 0 additions & 91 deletions
This file was deleted.

‎.github/actions/uv_setup/action.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# TODO: https://docs.astral.sh/uv/guides/integration/github/#caching
2+
3+
name: uv-install
4+
description: Set up Python and uv
5+
6+
inputs:
7+
python-version:
8+
description: Python version, supporting MAJOR.MINOR only
9+
required: true
10+
11+
runs:
12+
using: composite
13+
steps:
14+
- name: Install uv and set the python version
15+
uses: astral-sh/setup-uv@v5
16+
with:
17+
version: ${{ env.UV_VERSION }}
18+
python-version: ${{ inputs.python-version }}

‎.github/workflows/_lint.yml‎

Lines changed: 16 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -7,75 +7,35 @@ on:
77
required: true
88
type: string
99
description: "From which folder this pipeline executes"
10+
python-version:
11+
required: true
12+
type: string
13+
description: "Python version to use"
1014

1115
env:
12-
POETRY_VERSION: "1.7.1"
1316
WORKDIR: ${{ inputs.working-directory == '' && '.' || inputs.working-directory }}
1417

18+
# This env var allows us to get inline annotations when ruff has complaints.
19+
RUFF_OUTPUT_FORMAT: github
20+
UV_FROZEN: "true"
21+
1522
jobs:
1623
build:
24+
name: "make lint #${{ inputs.python-version }}"
1725
runs-on: ubuntu-latest
18-
env:
19-
# This number is set "by eye": we want it to be big enough
20-
# so that it's bigger than the number of commits in any reasonable PR,
21-
# and also as small as possible since increasing the number makes
22-
# the initial `git fetch` slower.
23-
FETCH_DEPTH: 50
24-
strategy:
25-
matrix:
26-
# Only lint on the min and max supported Python versions.
27-
# It's extremely unlikely that there's a lint issue on any version in between
28-
# that doesn't show up on the min or max versions.
29-
#
30-
# GitHub rate-limits how many jobs can be running at any one time.
31-
# Starting new jobs is also relatively slow,
32-
# so linting on fewer versions makes CI faster.
33-
python-version:
34-
- "3.9"
35-
- "3.11"
26+
timeout-minutes: 20
3627
steps:
37-
- uses: actions/checkout@v3
38-
- name: Set up Python ${{ matrix.python-version }} + Poetry ${{ env.POETRY_VERSION }}
39-
uses: "./.github/actions/poetry_setup"
40-
with:
41-
python-version: ${{ matrix.python-version }}
42-
poetry-version: ${{ env.POETRY_VERSION }}
43-
working-directory: ${{ inputs.working-directory }}
44-
cache-key: lint-with-extras
45-
46-
- name: Check Poetry File
47-
shell: bash
48-
working-directory: ${{ inputs.working-directory }}
49-
run: |
50-
poetry check
28+
- uses: actions/checkout@v4
5129

52-
- name: Check lock file
53-
shell: bash
54-
working-directory: ${{ inputs.working-directory }}
55-
run: |
56-
poetry lock --check
30+
- name: Set up Python ${{ inputs.python-version }} + uv
31+
uses: "./.github/actions/uv_setup"
32+
with:
33+
python-version: ${{ inputs.python-version }}
5734

5835
- name: Install dependencies
59-
# Also installs dev/lint/test/typing dependencies, to ensure we have
60-
# type hints for as many of our libraries as possible.
61-
# This helps catch errors that require dependencies to be spotted, for example:
62-
# https://github.com/langchain-ai/langchain/pull/10249/files#diff-935185cd488d015f026dcd9e19616ff62863e8cde8c0bee70318d3ccbca98341
63-
#
64-
# If you change this configuration, make sure to change the `cache-key`
65-
# in the `poetry_setup` action above to stop using the old cache.
66-
# It doesn't matter how you change it, any change will cause a cache-bust.
6736
working-directory: ${{ inputs.working-directory }}
6837
run: |
69-
poetry install --with dev,lint,test,typing
70-
71-
- name: Get .mypy_cache to speed up mypy
72-
uses: actions/cache@v3
73-
env:
74-
SEGMENT_DOWNLOAD_TIMEOUT_MIN: "2"
75-
with:
76-
path: |
77-
${{ env.WORKDIR }}/.mypy_cache
78-
key: mypy-${{ runner.os }}-${{ runner.arch }}-py${{ matrix.python-version }}-${{ inputs.working-directory }}-${{ hashFiles(format('{0}/poetry.lock', env.WORKDIR)) }}
38+
uv sync --group test
7939
8040
- name: Analysing the code with our lint
8141
working-directory: ${{ inputs.working-directory }}

‎.github/workflows/_release.yml‎

Lines changed: 116 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: release
2-
2+
run-name: Release ${{ inputs.working-directory }} by @${{ github.actor }}
33
on:
44
workflow_call:
55
inputs:
@@ -10,17 +10,79 @@ on:
1010
workflow_dispatch:
1111
inputs:
1212
working-directory:
13+
description: "From which folder this pipeline executes"
14+
default: "libs/server"
1315
required: true
14-
type: string
15-
default: '.'
16+
type: choice
17+
options:
18+
- "."
19+
dangerous-nonmain-release:
20+
required: false
21+
type: boolean
22+
default: false
23+
description: "Release from a non-main branch (danger!)"
1624

1725
env:
18-
POETRY_VERSION: "1.7.1"
26+
PYTHON_VERSION: "3.11"
27+
UV_FROZEN: "true"
28+
UV_NO_SYNC: "true"
1929

2030
jobs:
21-
if_release:
22-
# Disallow publishing from branches that aren't `main`.
23-
if: github.ref == 'refs/heads/main'
31+
build:
32+
if: github.ref == 'refs/heads/main' || inputs.dangerous-nonmain-release
33+
environment: Scheduled testing
34+
runs-on: ubuntu-latest
35+
36+
outputs:
37+
pkg-name: ${{ steps.check-version.outputs.pkg-name }}
38+
version: ${{ steps.check-version.outputs.version }}
39+
40+
steps:
41+
- uses: actions/checkout@v4
42+
43+
- name: Set up Python + uv
44+
uses: "./.github/actions/uv_setup"
45+
with:
46+
python-version: ${{ env.PYTHON_VERSION }}
47+
48+
# We want to keep this build stage *separate* from the release stage,
49+
# so that there's no sharing of permissions between them.
50+
# The release stage has trusted publishing and GitHub repo contents write access,
51+
# and we want to keep the scope of that access limited just to the release job.
52+
# Otherwise, a malicious `build` step (e.g. via a compromised dependency)
53+
# could get access to our GitHub or PyPI credentials.
54+
#
55+
# Per the trusted publishing GitHub Action:
56+
# > It is strongly advised to separate jobs for building [...]
57+
# > from the publish job.
58+
# https://github.com/pypa/gh-action-pypi-publish#non-goals
59+
- name: Build project for distribution
60+
run: uv build
61+
working-directory: ${{ inputs.working-directory }}
62+
- name: Upload build
63+
uses: actions/upload-artifact@v4
64+
with:
65+
name: dist
66+
path: ${{ inputs.working-directory }}/dist/
67+
68+
- name: Check Version
69+
id: check-version
70+
shell: python
71+
working-directory: ${{ inputs.working-directory }}
72+
run: |
73+
import os
74+
import tomllib
75+
with open("pyproject.toml", "rb") as f:
76+
data = tomllib.load(f)
77+
pkg_name = data["project"]["name"]
78+
version = data["project"]["version"]
79+
with open(os.environ["GITHUB_OUTPUT"], "a") as f:
80+
f.write(f"pkg-name={pkg_name}\n")
81+
f.write(f"version={version}\n")
82+
83+
publish:
84+
needs:
85+
- build
2486
runs-on: ubuntu-latest
2587
permissions:
2688
# This permission is used for trusted publishing:
@@ -30,37 +92,23 @@ jobs:
3092
# https://docs.pypi.org/trusted-publishers/adding-a-publisher/
3193
id-token: write
3294

33-
# This permission is needed by `ncipollo/release-action` to create the GitHub release.
34-
contents: write
3595
defaults:
3696
run:
3797
working-directory: ${{ inputs.working-directory }}
98+
3899
steps:
39-
- uses: actions/checkout@v3
100+
- uses: actions/checkout@v4
40101

41-
- name: Set up Python + Poetry ${{ env.POETRY_VERSION }}
42-
uses: "./.github/actions/poetry_setup"
102+
- name: Set up Python + uv
103+
uses: "./.github/actions/uv_setup"
43104
with:
44-
python-version: "3.10"
45-
poetry-version: ${{ env.POETRY_VERSION }}
46-
working-directory: ${{ inputs.working-directory }}
47-
cache-key: release
105+
python-version: ${{ env.PYTHON_VERSION }}
48106

49-
- name: Build project for distribution
50-
run: poetry build
51-
- name: Check Version
52-
id: check-version
53-
run: |
54-
echo version=$(poetry version --short) >> $GITHUB_OUTPUT
55-
- name: Create Release
56-
uses: ncipollo/release-action@v1
107+
- uses: actions/download-artifact@v4
57108
with:
58-
artifacts: "dist/*"
59-
token: ${{ secrets.GITHUB_TOKEN }}
60-
draft: false
61-
generateReleaseNotes: true
62-
tag: v${{ steps.check-version.outputs.version }}
63-
commit: main
109+
name: dist
110+
path: ${{ inputs.working-directory }}/dist/
111+
64112
- name: Publish package distributions to PyPI
65113
uses: pypa/gh-action-pypi-publish@release/v1
66114
with:
@@ -69,3 +117,41 @@ jobs:
69117
print-hash: true
70118
# Temp workaround since attestations are on by default as of gh-action-pypi-publish v1.11.0
71119
attestations: false
120+
121+
mark-release:
122+
needs:
123+
- build
124+
- publish
125+
runs-on: ubuntu-latest
126+
permissions:
127+
# This permission is needed by `ncipollo/release-action` to
128+
# create the GitHub release.
129+
contents: write
130+
131+
defaults:
132+
run:
133+
working-directory: ${{ inputs.working-directory }}
134+
135+
steps:
136+
- uses: actions/checkout@v4
137+
138+
- name: Set up Python + uv
139+
uses: "./.github/actions/uv_setup"
140+
with:
141+
python-version: ${{ env.PYTHON_VERSION }}
142+
143+
- uses: actions/download-artifact@v4
144+
with:
145+
name: dist
146+
path: ${{ inputs.working-directory }}/dist/
147+
148+
- name: Create Tag
149+
uses: ncipollo/release-action@v1
150+
with:
151+
artifacts: "dist/*"
152+
token: ${{ secrets.GITHUB_TOKEN }}
153+
generateReleaseNotes: true
154+
tag: ${{needs.build.outputs.pkg-name}}==${{ needs.build.outputs.version }}
155+
body: ${{ needs.release-notes.outputs.release-body }}
156+
commit: main
157+
makeLatest: true

0 commit comments

Comments
 (0)