From 4db6c4a816b013f187ca72a1d9dd06a8091b50c4 Mon Sep 17 00:00:00 2001 From: ohmayr Date: Tue, 27 Oct 2026 23:09:32 +0000 Subject: [PATCH] chore(crc32c): retire direct worker-to-PyPI twine upload in release scripts Remove direct twine upload invocations and PyPI API token keystore fetches from the Linux (manylinux), macOS (OSX/ARM64), and Windows release build scripts and Kokoro release configurations for google-crc32c. With OSS Exit Gate enabled for google-crc32c, platform release jobs now exclusively build, test, run twine check, and export wheel/sdist artifacts to GCS (is_release_artifact: true), while downstream promotion to PyPI is handled via Rapid / Louhi and the OSS Exit Gate service. --- .kokoro/release/crc32c/linux/common.cfg | 20 -------------- .kokoro/release/crc32c/osx/common.cfg | 20 -------------- .../release/crc32c/release-manylinux-wheel.sh | 4 +-- .kokoro/release/crc32c/release-osx-wheel.sh | 4 +-- .../release/crc32c/release-windows-wheel.bat | 4 +-- .kokoro/release/crc32c/windows/common.cfg | 20 -------------- .../google-crc32c/scripts/manylinux/build.sh | 26 ++----------------- .../scripts/manylinux/publish_python_wheel.sh | 17 ++---------- .../scripts/osx/publish_python_wheel.sh | 15 +---------- .../google-crc32c/scripts/windows/build.bat | 21 +-------------- 10 files changed, 9 insertions(+), 142 deletions(-) diff --git a/.kokoro/release/crc32c/linux/common.cfg b/.kokoro/release/crc32c/linux/common.cfg index d10f7a77b6e7..2c2758f84da0 100644 --- a/.kokoro/release/crc32c/linux/common.cfg +++ b/.kokoro/release/crc32c/linux/common.cfg @@ -14,23 +14,3 @@ action { strip_prefix: "github/google-cloud-python/packages/google-crc32c" } } - -# Fetch the token needed for reporting release status to GitHub -before_action { - fetch_keystore { - keystore_resource { - keystore_config_id: 73713 - keyname: "yoshi-automation-github-key" - } - } -} - -# Fetch PyPI password -before_action { - fetch_keystore { - keystore_resource { - keystore_config_id: 73713 - keyname: "google-cloud-pypi-token-keystore-3" - } - } -} diff --git a/.kokoro/release/crc32c/osx/common.cfg b/.kokoro/release/crc32c/osx/common.cfg index d10f7a77b6e7..2c2758f84da0 100644 --- a/.kokoro/release/crc32c/osx/common.cfg +++ b/.kokoro/release/crc32c/osx/common.cfg @@ -14,23 +14,3 @@ action { strip_prefix: "github/google-cloud-python/packages/google-crc32c" } } - -# Fetch the token needed for reporting release status to GitHub -before_action { - fetch_keystore { - keystore_resource { - keystore_config_id: 73713 - keyname: "yoshi-automation-github-key" - } - } -} - -# Fetch PyPI password -before_action { - fetch_keystore { - keystore_resource { - keystore_config_id: 73713 - keyname: "google-cloud-pypi-token-keystore-3" - } - } -} diff --git a/.kokoro/release/crc32c/release-manylinux-wheel.sh b/.kokoro/release/crc32c/release-manylinux-wheel.sh index e90daee9e8ad..c0514c4a807a 100755 --- a/.kokoro/release/crc32c/release-manylinux-wheel.sh +++ b/.kokoro/release/crc32c/release-manylinux-wheel.sh @@ -17,7 +17,5 @@ set -eo pipefail cd github/google-cloud-python/packages/google-crc32c -export PUBLISH_WHEELS="${PUBLISH_WHEELS:-true}" - -# Build and publish ManyLinux wheels +# Build ManyLinux wheels ./scripts/manylinux/build.sh diff --git a/.kokoro/release/crc32c/release-osx-wheel.sh b/.kokoro/release/crc32c/release-osx-wheel.sh index 3b152d6cb75d..33a01479e161 100755 --- a/.kokoro/release/crc32c/release-osx-wheel.sh +++ b/.kokoro/release/crc32c/release-osx-wheel.sh @@ -18,7 +18,5 @@ set -eo pipefail export REPO_ROOT=$(pwd)/github/google-cloud-python/packages/google-crc32c cd "${REPO_ROOT}" -export PUBLISH_WHEELS="${PUBLISH_WHEELS:-true}" - -# Build and publish OSX wheels +# Build OSX wheels ./scripts/osx/build.sh diff --git a/.kokoro/release/crc32c/release-windows-wheel.bat b/.kokoro/release/crc32c/release-windows-wheel.bat index 42e044683710..d68633da6a9a 100644 --- a/.kokoro/release/crc32c/release-windows-wheel.bat +++ b/.kokoro/release/crc32c/release-windows-wheel.bat @@ -16,9 +16,7 @@ cd /d %~dp0..\..\..\packages\google-crc32c || goto :error -if "%PUBLISH_WHEELS%"=="" set PUBLISH_WHEELS=true - -@echo "Build, Test, and Publish Wheels" +@echo "Build and Test Wheels" call scripts\windows\build.bat || goto :error goto :EOF diff --git a/.kokoro/release/crc32c/windows/common.cfg b/.kokoro/release/crc32c/windows/common.cfg index 85cf1a429a49..431043fdc908 100644 --- a/.kokoro/release/crc32c/windows/common.cfg +++ b/.kokoro/release/crc32c/windows/common.cfg @@ -20,23 +20,3 @@ action { strip_prefix: "github/google-cloud-python/packages/google-crc32c" } } - -# Fetch the token needed for reporting release status to GitHub -before_action { - fetch_keystore { - keystore_resource { - keystore_config_id: 73713 - keyname: "yoshi-automation-github-key" - } - } -} - -# Fetch PyPI password -before_action { - fetch_keystore { - keystore_resource { - keystore_config_id: 73713 - keyname: "google-cloud-pypi-token-keystore-3" - } - } -} diff --git a/packages/google-crc32c/scripts/manylinux/build.sh b/packages/google-crc32c/scripts/manylinux/build.sh index 4116db5157e7..61f0cfd69c4e 100755 --- a/packages/google-crc32c/scripts/manylinux/build.sh +++ b/packages/google-crc32c/scripts/manylinux/build.sh @@ -21,14 +21,6 @@ MANYLINUX_DIR=$(echo $(cd $(dirname ${0}); pwd)) SCRIPTS_DIR=$(dirname ${MANYLINUX_DIR}) REPO_ROOT=$(dirname ${SCRIPTS_DIR}) -if [[ "${PUBLISH_WHEELS}" == "true" ]]; then - KEYSTORE_FILE="${KOKORO_KEYSTORE_DIR}/73713_google-cloud-pypi-token-keystore-3" - if [[ ! -s "${KEYSTORE_FILE}" ]]; then - echo "ERROR [pre-flight]: PyPI token missing or empty at '${KEYSTORE_FILE}'." >&2 - exit 1 - fi -fi - cd $REPO_ROOT # Add directory as safe to avoid "detected dubious ownership" fatal issue1 git config --global --add safe.directory '*' @@ -55,25 +47,11 @@ docker run \ quay.io/pypa/manylinux2014_aarch64 \ /var/code/python-crc32c/scripts/manylinux/build_on_centos.sh -DOCKER_VOLUMES=(--volume "${REPO_ROOT}:/var/code/python-crc32c/") -if [[ -d "/tmpfs" ]]; then - DOCKER_VOLUMES+=(--volume "/tmpfs:/tmpfs") -fi -if [[ -n "${KOKORO_KEYSTORE_DIR}" && -d "${KOKORO_KEYSTORE_DIR}" && "${KOKORO_KEYSTORE_DIR}" != /tmpfs/* ]]; then - DOCKER_VOLUMES+=(--volume "${KOKORO_KEYSTORE_DIR}:${KOKORO_KEYSTORE_DIR}") -fi - docker run \ --rm \ --interactive \ - "${DOCKER_VOLUMES[@]}" \ + --volume ${REPO_ROOT}:/var/code/python-crc32c/ \ --env REPO_ROOT=/var/code/python-crc32c \ - --env BUILD_PYTHON \ - --env PUBLISH_WHEELS \ - --env KOKORO_KEYSTORE_DIR \ - --env KOKORO_GFILE_DIR \ - --env KOKORO_BUILD_ID \ - --env KOKORO_GITHUB_COMMIT \ - --env KOKORO_GITHUB_PULL_REQUEST_NUMBER \ + --env BUILD_PYTHON=${BUILD_PYTHON} \ quay.io/pypa/manylinux2014_x86_64 \ /var/code/python-crc32c/scripts/manylinux/publish_python_wheel.sh diff --git a/packages/google-crc32c/scripts/manylinux/publish_python_wheel.sh b/packages/google-crc32c/scripts/manylinux/publish_python_wheel.sh index 9ba096c5fe7b..96c965575078 100755 --- a/packages/google-crc32c/scripts/manylinux/publish_python_wheel.sh +++ b/packages/google-crc32c/scripts/manylinux/publish_python_wheel.sh @@ -18,8 +18,7 @@ set -eo pipefail REPO_ROOT="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}" # This script runs as a container entrypoint in quay.io/pypa/manylinux2014_x86_64. -# The venv is load-bearing: `releasetool publish-reporter-script` emits bash that -# hardcodes `python3`, which does not exist in this image outside a venv. +# Run twine check inside an isolated Python 3.12 virtual environment. PYTHON_BIN="/opt/python/cp312-cp312/bin/python" if [[ ! -x "${PYTHON_BIN}" ]]; then echo "ERROR: ${PYTHON_BIN} not found; run this inside manylinux2014_x86_64." >&2 @@ -56,16 +55,4 @@ for VER in ${VERSIONS_TO_CHECK}; do done python -m twine check "${REPO_ROOT}/wheels/"* - -if [[ "${PUBLISH_WHEELS}" == "true" ]]; then - # Start the releasetool reporter - python -m pip install --upgrade gcp-releasetool - python -m releasetool publish-reporter-script > /tmp/publisher-script; source /tmp/publisher-script - - # Disable logging - set +x - TWINE_PASSWORD=$(cat "${KOKORO_KEYSTORE_DIR}/73713_google-cloud-pypi-token-keystore-3") - python -m twine upload --skip-existing --username __token__ --password "${TWINE_PASSWORD}" "${REPO_ROOT}/wheels/"* -else - echo "PUBLISH_WHEELS is not 'true'; skipping PyPI upload after twine check." -fi +echo "Linux wheels are ready for Kokoro / OSS Exit Gate aggregation." diff --git a/packages/google-crc32c/scripts/osx/publish_python_wheel.sh b/packages/google-crc32c/scripts/osx/publish_python_wheel.sh index b12b20770d35..a0a104b2e69f 100755 --- a/packages/google-crc32c/scripts/osx/publish_python_wheel.sh +++ b/packages/google-crc32c/scripts/osx/publish_python_wheel.sh @@ -35,17 +35,4 @@ for VER in $(awk -F': ' '/^versions:/ {print $2}' "${REPO_ROOT}/scripts/python_v done "${PYTHON_EXE}" -m twine check "${REPO_ROOT}/wheels/"* - -if [[ "${PUBLISH_WHEELS}" == "true" ]]; then - # Start the releasetool reporter - "${PYTHON_EXE}" -m pip install --upgrade gcp-releasetool - "${PYTHON_EXE}" -m releasetool publish-reporter-script > /tmp/publisher-script - source /tmp/publisher-script - - # Disable logging - set +x - TWINE_PASSWORD=$(cat "${KOKORO_KEYSTORE_DIR}/73713_google-cloud-pypi-token-keystore-3") - "${PYTHON_EXE}" -m twine upload --skip-existing --username __token__ --password "${TWINE_PASSWORD}" "${REPO_ROOT}/wheels/"* -else - echo "PUBLISH_WHEELS is not set to 'true'. Skipping releasetool and twine upload (dry-run validation passed)." -fi +echo "macOS wheels are ready for Kokoro / OSS Exit Gate aggregation." diff --git a/packages/google-crc32c/scripts/windows/build.bat b/packages/google-crc32c/scripts/windows/build.bat index f4f6645e2fe6..20ffe104645a 100644 --- a/packages/google-crc32c/scripts/windows/build.bat +++ b/packages/google-crc32c/scripts/windows/build.bat @@ -113,26 +113,7 @@ py -3 -m pip install --upgrade twine wheel setuptools pkginfo || goto :error echo "Build the source distribution (sdist) and validate with twine check" py -3 setup.py sdist || goto :error py -3 -m twine check dist/* wheels/* || goto :error - -if "%PUBLISH_WHEELS%"=="true" ( - echo "Start the releasetool reporter" - py -3 -m pip install gcp-releasetool || goto :error - if not exist C:\temp mkdir C:\temp - py -3 -m releasetool publish-reporter-script > C:\temp\publisher-script || goto :error - - echo "Disable buffering, so that the logs stream through." - set PYTHONUNBUFFERED=1 - - echo "## RELEASE WORKFLOW SUCCESSFUL ##" - echo "## Uploading Wheels and sdist ##" - - set /p TWINE_PASSWORD=<%KOKORO_KEYSTORE_DIR%/73713_google-cloud-pypi-token-keystore-3 - py -3 -m twine upload --skip-existing --username __token__ --password "!TWINE_PASSWORD!" dist/* wheels/* || goto :error - dir wheels - dir dist -) else ( - echo "PUBLISH_WHEELS is '%PUBLISH_WHEELS%'. Skipping PyPI upload after sdist and wheel validation." -) +echo "Windows wheels and sdist are ready for Kokoro / OSS Exit Gate aggregation." goto :EOF