python-publish-release.yml

name: Publish release
on:
  workflow_call:
    inputs:
      name:
        description: The name of the package to publish
        type: string
        required: true
      python-version:
        description: The Python version to use
        type: number
        required: false
        default: 3.12
      docs-requirements:
        description: The path to the requirements file to use for documentation building
        type: string
        required: false
        default: requirements/docs.txt
      build-requirements:
        description: The path to the requirements file to use for package building
        type: string
        required: false
        default: requirements/build.txt
      playbook-roles:
        description: The Logikal playbook roles to run (comma-separated list)
        type: string
        required: false
      playbook-vars:
        description: The Logikal playbook variables to set (string-encoded JSON)
        type: string
        required: false
        default: '{}'
      docs-workload-identity-provider:
        description: Full identifier of the GitHub workload identity pool provider in Google Cloud
        type: string
        required: true
      docs-service-account-email:
        description: Email of the Google Cloud service account for publishing documentation files
        type: string
        required: true
      docs-bucket-name:
        description: The bucket name to upload the documentation to
        type: string
        required: true
      docs-url-map-name:
        description: The URL map name to use for CDN cache invalidation
        type: string
        required: true
      docs-http-to-https-url-map-name:
        description: The HTTP to HTTPS redirection URL map name to use for CDN cache invalidation
        type: string
        required: true

    secrets:
      PYPI_API_TOKEN:
        description: The PyPI access token to use for uploading the package
        required: true

concurrency: python-publish-release-${{ github.workflow_ref }}-${{ github.ref || github.run_id }}

jobs:
  publish-docs:
    name: Publish documentation
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Authenticate to Google Cloud Platform
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ inputs.docs-workload-identity-provider }}
          service_account: ${{ inputs.docs-service-account-email }}

      - name: Install gcloud CLI
        uses: google-github-actions/setup-gcloud@v3

      - name: Install Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ inputs.python-version }}

      - name: Run playbooks
        uses: logikal-io/run-logikal-playbook@v2
        if: inputs.playbook-roles != ''
        with:
          roles: ${{ inputs.playbook-roles }}
          vars: ${{ inputs.playbook-vars }}

      - name: Install requirements
        uses: logikal-io/make-orb@v1
        with:
          requirements: ${{ inputs.docs-requirements }}

      - name: Get latest tag
        id: tags
        run: echo "latest=$(git tag -l --sort=version:refname | tail -n 1)" >> $GITHUB_OUTPUT

      - name: Build documentation
        run: orb --command 'docs --build'

      - name: Upload documentation
        shell: bash
        env:
          tag: ${{ github.ref_name }}
        run: |-
          version="${tag:1}"
          if [[ ! ${version} ]]; then
            echo 'Invalid tag'
            exit 1
          fi
          gsutil -m rsync -r -d -j html,css,js -x "\.buildinfo|\.doctrees" \
            docs/build "gs://${{ inputs.docs-bucket-name }}/${{ inputs.name }}/${version}"

      - name: Upload latest documentation
        if: github.ref_name == steps.tags.outputs.latest
        run: >-
          gsutil -m rsync -r -d -j html,css,js -x "\.buildinfo|\.doctrees" \
            docs/build "gs://${{ inputs.docs-bucket-name }}/${{ inputs.name }}/latest"

      - name: Invalidate CDN cache
        if: github.ref_name == steps.tags.outputs.latest
        run: |-
          gcloud compute url-maps invalidate-cdn-cache \
            "${{ inputs.docs-url-map-name }}" --path "/${{ inputs.name }}/latest/*"
          gcloud compute url-maps invalidate-cdn-cache \
            "${{ inputs.docs-http-to-https-url-map-name }}" --path "/${{ inputs.name }}/latest/*"

  publish-package:
    name: Publish package
    runs-on: ubuntu-24.04
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Install Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ inputs.python-version }}

      - name: Install requirements
        uses: logikal-io/make-orb@v1
        with:
          requirements: ${{ inputs.build-requirements }}

      - name: Build package
        run: orb --command 'python -m build --sdist --wheel'

      - name: Upload package
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: orb --command 'twine upload --non-interactive dist/*'