Add registry-backed module package releases

.gitea/workflows/publish-developer-meta-package.yml

@@ -0,0 +1,60 @@
+name: Developer Meta-package Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  publish-package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.12"
+      - name: Validate protected release tag and package version
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          python - <<'PY'
+          import fnmatch
+          import json
+          import os
+          from pathlib import Path
+          import subprocess
+          import tomllib
+          import urllib.request
+
+          tag = os.environ["GITEA_REF_NAME"]
+          project = tomllib.loads(Path("packages/govoplan-meta/pyproject.toml").read_text(encoding="utf-8"))["project"]
+          if tag != f"v{project['version']}":
+              raise SystemExit("meta-package version does not match the release tag")
+          if subprocess.run(["git", "merge-base", "--is-ancestor", "HEAD", "origin/main"]).returncode:
+              raise SystemExit("release tag is not contained in main")
+          request = urllib.request.Request(
+              f"{os.environ['GITEA_API_URL']}/repos/{os.environ['GITEA_REPOSITORY']}/tag_protections",
+              headers={"Authorization": f"token {os.environ['GITEA_TOKEN']}"},
+          )
+          with urllib.request.urlopen(request, timeout=30) as response:
+              protections = json.load(response)
+          if not any(fnmatch.fnmatchcase(tag, item.get("name_pattern", "")) for item in protections):
+              raise SystemExit("release tag is not protected")
+          PY
+      - name: Build and publish developer package
+        env:
+          PACKAGE_USERNAME: ${{ secrets.GOVOPLAN_PACKAGE_USERNAME }}
+          PACKAGE_TOKEN: ${{ secrets.GOVOPLAN_PACKAGE_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "$PACKAGE_USERNAME"
+          test -n "$PACKAGE_TOKEN"
+          python -m pip install --disable-pip-version-check build==1.5.0 twine==7.0.0
+          python -m build --wheel --outdir dist packages/govoplan-meta
+          python -m twine check dist/*.whl
+          TWINE_USERNAME="$PACKAGE_USERNAME" TWINE_PASSWORD="$PACKAGE_TOKEN" \
+            python -m twine upload --non-interactive \
+              --repository-url https://git.add-ideas.de/api/packages/GovOPlaN/pypi \
+              dist/*.whl

.gitea/workflows/release-integration.yml

@@ -25,6 +25,12 @@ jobs:
       - name: Bootstrap GovOPlaN repositories
         working-directory: govoplan
         run: python tools/repo/bootstrap-repositories.py --parent .. --transport public-https --reuse-checkout-auth --exclude-repo addideas-govoplan-website
+      - name: Validate package publication contracts
+        working-directory: govoplan
+        run: |
+          python tools/repo/sync-module-package-workflows.py --check
+          python tools/release/generate-developer-meta-package.py --check
+          python -m unittest tests.test_module_package_workflows tests.test_package_registry_release
       - name: Install backend release integration dependencies
         working-directory: govoplan
         run: |

.gitea/workflows/runtime-distribution.yml

@@ -101,12 +101,27 @@ jobs:
         run: python tools/repo/bootstrap-repositories.py --parent .. --transport public-https --reuse-checkout-auth --exclude-repo addideas-govoplan-website
       - name: Build release wheel roots and WebUI
         working-directory: govoplan
+        env:
+          VERSION: ${{ inputs.version }}
+          GOVOPLAN_PACKAGE_USERNAME: ${{ secrets.GOVOPLAN_PACKAGE_USERNAME }}
+          GOVOPLAN_PACKAGE_TOKEN: ${{ secrets.GOVOPLAN_PACKAGE_TOKEN }}
         run: |
           python -m venv .runtime-build
-          .runtime-build/bin/python -m pip install --upgrade pip wheel cryptography
-          mkdir -p runtime-output/local-wheels
-          .runtime-build/bin/python -m pip wheel --no-deps --wheel-dir runtime-output/local-wheels --requirement requirements-release.txt
-          bash tools/release/install-webui-release-dependencies.sh ../govoplan-core/webui
+          .runtime-build/bin/python -m pip install --upgrade pip cryptography
+          .runtime-build/bin/python tools/release/generate-release-package-set.py \
+            --version "$VERSION" \
+            --output runtime-output/release-packages.json
+          .runtime-build/bin/python tools/release/resolve-package-artifacts.py \
+            --package-set runtime-output/release-packages.json \
+            --wheelhouse runtime-output/local-wheels \
+            --webui-packages runtime-output/webui-packages \
+            --lock-output runtime-output/package-artifacts.lock.json \
+            --requirements-output runtime-output/requirements-release.packages.txt \
+            --python .runtime-build/bin/python
+          PYTHON=.runtime-build/bin/python \
+            GOVOPLAN_WEBUI_PACKAGE_LOCK="$PWD/runtime-output/package-artifacts.lock.json" \
+            GOVOPLAN_WEBUI_PACKAGE_DIR="$PWD/runtime-output/webui-packages" \
+            bash tools/release/install-webui-release-dependencies.sh ../govoplan-core/webui
           npm --prefix ../govoplan-core/webui run build
           .runtime-build/bin/python tools/release/prepare-runtime-context.py \
             --wheelhouse runtime-output/local-wheels \
@@ -264,6 +279,7 @@ jobs:
             --web-metadata runtime-output/web-metadata.json \
             --deployer runtime-output/govoplan-deploy.pyz \
             --deployer-url "$ARTIFACT_BASE/govoplan-deploy.pyz" \
+            --package-lock runtime-output/package-artifacts.lock.json \
             --artifact-base-url "$ARTIFACT_BASE" \
             --source-commit "$SOURCE_COMMIT" \
             --version "$VERSION" \
@@ -361,6 +377,9 @@ jobs:
             --asset runtime-output/distribution-manifest.json.sha256 \
             --asset runtime-output/distribution-keyring.json \
             --asset runtime-output/context-amd64/composition.json \
+            --asset runtime-output/release-packages.json \
+            --asset runtime-output/package-artifacts.lock.json \
+            --asset runtime-output/requirements-release.packages.txt \
             --asset runtime-output/evidence/api-sbom.cdx.json \
             --asset runtime-output/evidence/web-sbom.cdx.json \
             --asset runtime-output/evidence/api-provenance.json \