release.yml

# This workflow tests and releases a new version of the package before publishing it to PyPi.

name: Release

# Only trigger when a pull request into main branch is merged.
on:
  pull_request:
    types: [closed]
    branches:
      - main

  workflow_dispatch:
    inputs:
      ref:
        description: "Branch or commit SHA to tag"
        type: string
        required: true
      tag:
        description: "Tag for release"
        type: string
        required: true

jobs:
  run-tests:
    if: "${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true }}"
    runs-on: ${{ matrix.os }}
    env:
      USING_COVERAGE: "3.10"
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    permissions:
      id-token: write
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Install Poetry
        uses: snok/install-poetry@v1.3.2

      - name: Check pyproject.toml file
        run: poetry check

      - name: Install tox
        run: pip install tox

      - name: Authenticate with Google Cloud
        id: auth
        uses: google-github-actions/auth@v0.6.0
        with:
          # NOTE: If setting create_credentials_file=true, .dockerignore file must include `gha-creds-*.json` to avoid baking these credentials into build
          create_credentials_file: true
          workload_identity_provider: "projects/437801218871/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider"
          service_account: "github-actions@octue-sdk-python.iam.gserviceaccount.com"

      - name: Run tests
        env:
          TEST_PROJECT_NAME: ${{ secrets.TEST_PROJECT_NAME }}
          GOOGLE_CLOUD_PROJECT: ${{ secrets.TEST_PROJECT_NAME }}
        run: tox -vv -e py

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: coverage.xml
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  release:
    runs-on: ubuntu-latest
    needs: run-tests
    steps:
      - name: Checkout Repository
        if: ${{ github.event_name != 'workflow_dispatch' }}
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}

      - name: Install Poetry
        if: ${{ github.event_name != 'workflow_dispatch' }}
        uses: snok/install-poetry@v1.3.2

      - name: Check pyproject.toml file
        if: ${{ github.event_name != 'workflow_dispatch' }}
        run: poetry check

      - name: Get package version
        id: get-package-version
        if: ${{ github.event_name != 'workflow_dispatch' }}
        run: echo "package_version=$(poetry version -s)" >> $GITHUB_OUTPUT

      - name: Create Release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, no need to create your own.
        with:
          commitish: ${{ inputs.ref }}
          tag_name: ${{ inputs.tag || steps.get-package-version.outputs.package_version }}
          release_name: ${{ github.event.pull_request.title }}
          body: ${{ github.event.pull_request.body }}
          draft: false
          prerelease: false

  publish:
    needs: release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - name: Install Poetry
        uses: snok/install-poetry@v1.3.4

      - name: Build a binary wheel and a source tarball
        run: poetry build

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@v1.8.10