.github/workflows/release.yml

# Copyright 2023 The Bazel Authors. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Cut a release whenever a new tag is pushed to the repo.
name: Release

on:
  push:
    tags:
      - "*.*.*"
  workflow_dispatch:
    inputs:
      tag_name:
        description: "release tag: tag that will be released"
        required: true
        type: string
      publish_to_pypi:
        description: 'Publish to PyPI'
        required: true
        type: boolean
        default: true
    secrets:
      publish_token:
        required: false

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.ref_name }}
      - name: Create release archive and notes
        run: .github/workflows/create_archive_and_notes.sh ${{ inputs.tag_name || github.ref_name }}
      - name: Release
        uses: softprops/action-gh-release@v2
        with:
          # Use GH feature to populate the changelog automatically
          generate_release_notes: true
          body_path: release_notes.txt
          prerelease: ${{ contains( (inputs.tag_name || github.ref), '-rc') }}
          fail_on_unmatched_files: true
          files: rules_python-*.tar.gz
          tag_name: ${{ inputs.tag_name || github.ref_name }}

  publish_bcr:
    needs: release
    uses: ./.github/workflows/publish.yml
    with:
      tag_name: ${{ inputs.tag_name || github.ref_name }}
    secrets:
      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}

  publish_pypi:
    # We just want publish_pypi last, since once uploaded, it can't be changed.
    name: Publish runfiles to PyPI
    needs: publish_bcr
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.tag_name || github.ref_name }}
      - if: github.event_name == 'push' || github.event.inputs.publish_to_pypi
        env:
          # This special value tells pypi that the user identity is supplied within the token
          TWINE_USERNAME: __token__
          # Note, the PYPI_API_TOKEN is for the rules-python pypi user, added by @rickylev on
          # https://github.com/bazel-contrib/rules_python/settings/secrets/actions
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: bazel run --stamp --embed_label=${{ inputs.tag_name || github.ref_name }} //python/runfiles:wheel.publish