[CLIENT-3467] CI/CD: Publish artifacts to JFrog using release bundles

.github/actions/get-artifact-for-stage-tests/action.yml

@@ -20,12 +20,24 @@ inputs:
     description: 'If getting wheel, what CPU arch is it built for? Must be the same in wheel name / cibw build identifier used to build wheel (e.g possible value: x86_64)'
   # Secrets
   JFROG_PLATFORM_URL:
-    required: false
-  JFROG_ACCESS_TOKEN:
+    description: For downloading the release bundle
     required: false
   # Variables
-  JFROG_REPO_NAME:
+  JFROG_PROJECT:
+    required: false
+    description: For downloading the release bundle
+  JFROG_RELEASE_BUNDLE_NAME:
+    required: false
+    description: For downloading the release bundle
+  JFROG_BUILD_NAME:
+    required: false
+    description: For downloading the release bundle
+  OIDC_PROVIDER_NAME:
     required: false
+    description: For downloading the release bundle
+  OIDC_AUDIENCE:
+    required: false
+    description: For downloading the release bundle
 
 runs:
   using: 'composite'
@@ -70,13 +82,22 @@ runs:
   # End codepath that downloads artifacts from Github
   # Begin codepath that downloads from JFrog
 
-  - uses: step-security/setup-jfrog-cli@a6b41f8338bea0983ddff6bd4ede7d2dcd81e1fa # v4.8.1
-    if: ${{ inputs.get_from_jfrog == 'true' }}
+  - if: ${{ inputs.get_from_jfrog == 'true' }}
+    uses: step-security/setup-jfrog-cli@a6b41f8338bea0983ddff6bd4ede7d2dcd81e1fa # v4.8.1
     env:
       JF_URL: ${{ inputs.JFROG_PLATFORM_URL }}
-      JF_ACCESS_TOKEN: ${{ inputs.JFROG_ACCESS_TOKEN }}
+      JF_PROJECT: ${{ inputs.JFROG_PROJECT }}
+    with:
+      oidc-provider-name: ${{ inputs.OIDC_PROVIDER_NAME }}
+      oidc-audience: ${{ inputs.OIDC_AUDIENCE }}
 
   - name: Download artifact from JFrog
     if: ${{ inputs.get_from_jfrog == 'true' }}
-    run: jf rt dl --fail-no-op --flat --build python-client/${{ inputs.jfrog_build_version }} "${{ inputs.JFROG_REPO_NAME }}/**/${{ env.ARTIFACT_FILE_NAME_PATTERN }}"
+    run: |
+      bundle_version=$(jf rbs --format json --order-by created versions ${{ inputs.JFROG_RELEASE_BUNDLE_NAME }} | jq -r '.release_bundles[0].release_bundle_version')
+      # Currently no way to download specific artifacts from a release bundle
+      # Using ARTIFACT_FILE_NAME_PATTERN with jf rt dl --bundle doesn't work
+      build_number="${bundle_version##*-}"
+      artifact_path=$(jf rt s --fail-no-op --build ${{ inputs.JFROG_BUILD_NAME }}/$build_number "${{ inputs.JFROG_PROJECT }}-pypi-dev-local/**/$ARTIFACT_FILE_NAME_PATTERN" | jq -r '.[0].path')
+      jf rt dl --fail-no-op --flat $artifact_path
     shell: bash

.github/workflows/build-and-run-stage-tests.yml

@@ -41,7 +41,6 @@ jobs:
     uses: ./.github/workflows/build-wheels.yml
     with:
       platform-tag: ${{ matrix.platform-tag }}
-      sha-to-build-and-test: ${{ github.sha }}
     secrets: inherit
 
   build-sdist:

.github/workflows/build-and-upload-wheels-for-qe.yml

@@ -27,7 +27,6 @@ jobs:
     with:
       platform-tag: ${{ matrix.platform-tag }}
       unoptimized: ${{ github.event_name == 'workflow_dispatch' && inputs.disable-optimizations || false }}
-      sha-to-build-and-test: ${{ github.sha }}
     secrets: inherit
 
   upload-to-jfrog:

.github/workflows/build-artifacts.yml

@@ -57,12 +57,6 @@ on:
         type: boolean
         default: true
         required: false
-      # This input is only used in workflow_call events
-      sha-to-build-and-test:
-        description: A calling workflow may want to run this workflow on a different ref than the calling workflow's ref
-        type: string
-        # Make it required to make things simple
-        required: true
       # A calling workflow doesn't actually set values to the inputs below
       # But that workflow needs to have default values for these inputs
       unoptimized:
@@ -100,8 +94,6 @@ on:
 jobs:
   build-sdist:
     uses: ./.github/workflows/build-sdist.yml
-    with:
-      sha_to_build: ${{ inputs.is_workflow_call == true && inputs.sha-to-build-and-test || github.sha }}
 
   build-wheels:
     strategy:
@@ -117,8 +109,6 @@ jobs:
     uses: ./.github/workflows/build-wheels.yml
     with:
       platform-tag: ${{ matrix.platform-tag }}
-      # Can't use env context here, so just copy from build-sdist env var
-      sha-to-build-and-test: ${{ inputs.is_workflow_call == true && inputs.sha-to-build-and-test || github.sha }}
       unoptimized: ${{ inputs.unoptimized }}
       include-debug-info-for-macos: ${{ inputs.include-debug-info-for-macos }}
       registry-name: ${{ inputs.registry-name }}