python-sdk/.github/workflows/main.yaml at main · openfga/python-sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
name: Build, Test and Publish

on:
  merge_group:
  push:
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
        urllib3-version: ["1.26.19", "2.2.2"]

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Set up uv and Python
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          version: "0.8.17"
          checksum: "920cbcaad514cc185634f6f0dcd71df5e8f4ee4456d440a22e0f8c0f142a8203"
          python-version: ${{ matrix.python-version }}
          enable-cache: true
          cache-dependency-glob: "**/pyproject.toml"

      - name: Install dependencies
        run: |
          uv sync
          uv pip install "urllib3==${{ matrix.urllib3-version }}"

      - if: matrix.python-version == '3.10' && matrix.urllib3-version == '1.26.19'
        name: Run `ruff`
        run: uv run ruff check

      - name: Run tests and collect coverage
        run: uv run pytest --cov-fail-under 60 --cov openfga_sdk

      - if: matrix.python-version == '3.10' && matrix.urllib3-version == '1.26.19'
        name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        continue-on-error: true
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: openfga/python-sdk

  verify-version:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [test]

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Verify versions match
        run: |
          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
          MANIFEST_VERSION=$(jq -r '.["."]' .release-please-manifest.json)
          PYPROJECT_VERSION=$(python3 -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')

          echo "Tag: $TAG_VERSION | Manifest: $MANIFEST_VERSION | pyproject.toml: $PYPROJECT_VERSION"

          if [[ "$TAG_VERSION" != "$MANIFEST_VERSION" ]]; then
            echo "ERROR: Tag version does not match manifest version"
            exit 1
          fi
          if [[ "$PYPROJECT_VERSION" != "$MANIFEST_VERSION" ]]; then
            echo "ERROR: pyproject.toml version does not match manifest version"
            exit 1
          fi
          echo "All versions verified: $TAG_VERSION"

  publish:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [verify-version]

    permissions:
      id-token: write # Required for PyPI trusted publishing

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Set up uv and Python
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          version: "0.8.17"
          checksum: "920cbcaad514cc185634f6f0dcd71df5e8f4ee4456d440a22e0f8c0f142a8203"
          python-version: "3.10"
          enable-cache: true
          cache-dependency-glob: "**/pyproject.toml"

      - name: Install dependencies
        run: uv sync

      - name: Build package
        run: uv build

      - name: Publish package
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

  undraft-release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [publish]
    permissions:
      contents: write
    uses: openfga/.github/.github/workflows/undraft-release.yml@835baf31562809ad9eb884c73efc5b79318f700f # pin@main