.github/workflows/release_publish.yaml

# Copyright 2023 The Bazel Authors. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Cut a release whenever a new tag is pushed to the repo.
name: "Release: Publish"

on:
  push:
    tags:
      - "*.*.*"
  workflow_dispatch:
    inputs:
      tag_name:
        description: "release tag: tag that will be released"
        required: true
        type: string
      publish_to_pypi:
        description: 'Publish to PyPI'
        required: true
        type: boolean
        default: true
    secrets:
      publish_token:
        required: false
  workflow_call:
    inputs:
      tag_name:
        description: "release tag: tag that will be released"
        required: true
        type: string
      publish_to_pypi:
        description: 'Publish to PyPI'
        required: false
        type: boolean
        default: true

jobs:
  build_artifacts:
    # Builds the release archive, release notes, runfiles wheel, and platform
    # binaries. A failed platform binary build only adds a warning to this run,
    # since releases don't require those binaries yet. The run fails if a build
    # hangs past the job timeout, the built files fail their checks, the wheel
    # or archive fails to build, or the ref's dev/platforms lacks a job's
    # platform.
    name: Build artifacts
    uses: ./.github/workflows/release_build_artifacts.yaml
    with:
      ref: ${{ inputs.tag_name || github.ref_name }}
    secrets: inherit

  release:
    name: Release
    needs: build_artifacts
    runs-on: ubuntu-latest
    steps:
      - name: Download release archive and notes
        uses: actions/download-artifact@v8
        with:
          name: release-archive

      - name: Download built artifacts
        uses: actions/download-artifact@v8
        with:
          # Match platform triples (<cpu>-<vendor>-<os>), excluding
          # release-artifacts-manifest.
          pattern: release-artifacts-*-*
          path: release-artifacts
          merge-multiple: true

      - name: Release
        uses: softprops/action-gh-release@v3
        with:
          # Use GH feature to populate the changelog automatically
          generate_release_notes: true
          body_path: release_notes.txt
          draft: false
          prerelease: ${{ contains( (inputs.tag_name || github.ref), '-rc') }}
          fail_on_unmatched_files: true
          files: |
            rules_python-*.tar.gz
            release-artifacts/*
            SHA256SUMS
          tag_name: ${{ inputs.tag_name || github.ref_name }}

  publish_bcr:
    needs: release
    uses: ./.github/workflows/publish.yml
    with:
      tag_name: ${{ inputs.tag_name || github.ref_name }}
    secrets:
      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}

  publish_pypi:
    # We just want publish_pypi last, since once uploaded, it can't be changed.
    needs: publish_bcr
    if: github.event_name == 'push' || inputs.publish_to_pypi
    uses: ./.github/workflows/publish_pypi.yaml
    with:
      tag_name: ${{ inputs.tag_name || github.ref_name }}
    secrets: inherit