coordinode-python/.github/workflows/release-please.yml at main · structured-world/coordinode-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
name: Release Please

on:
  push:
    branches:
      - main

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    steps:
      - name: Generate release bot token
        id: app-token
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # v3.3.0
        with:
          app-id: ${{ secrets.RELEASER_APP_ID }}
          private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}

      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7  # v5.0.0
        id: rp
        with:
          token: ${{ steps.app-token.outputs.token }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

      # The release PR bumps the workspace version in pyproject.toml, and
      # uv.lock records that version too. Left stale, every `uv sync --locked`
      # in CI refuses the branch, and without --locked uv re-resolves, which
      # builds source distributions. release-please cannot edit the lock
      # itself: its TOML updater cannot select the workspace entry by name.
      # So the lock is refreshed here, on the release branch, whenever the
      # release PR was created or updated. Pushed with the bot token so CI
      # runs on the new commit.
      - name: Check out the release branch
        if: steps.rp.outputs.pr
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          ref: ${{ fromJSON(steps.rp.outputs.pr).headBranchName }}
          token: ${{ steps.app-token.outputs.token }}
          # hatch-vcs derives the member versions from tags while locking.
          fetch-depth: 0

      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
        if: steps.rp.outputs.pr
        with:
          python-version: "3.11"

      - name: Sync uv.lock with the release version
        if: steps.rp.outputs.pr
        # Locking reads the workspace members' metadata, and their version is
        # dynamic (hatch-vcs), so uv has to build these three packages of this
        # repository; --no-build refuses exactly that. Third-party packages
        # keep their locked versions, and the CI run this push triggers
        # installs them with `--locked --no-build`, failing if any of them
        # would need a source build.
        run: uv lock  # NOSONAR
      - name: Commit the refreshed lock
        if: steps.rp.outputs.pr
        # A step's env is evaluated before its if, so it carries the raw
        # output and the branch is read here: fromJSON on the empty output of
        # a run that opened no release PR would fail the whole job.
        env:
          RELEASE_PR: ${{ steps.rp.outputs.pr }}
        run: |
          BRANCH=$(jq -r '.headBranchName' <<< "$RELEASE_PR")
          if git diff --quiet -- uv.lock; then
            echo "uv.lock already matches the release version"
            exit 0
          fi
          git config user.name "sw-release-bot[bot]"
          git config user.email "255865126+sw-release-bot[bot]@users.noreply.github.com"
          git add uv.lock
          git commit -m "chore: sync uv.lock with the release version"
          git push origin "HEAD:$BRANCH"