Add registry-backed module package releases

2026-08-04 04:14:28 +02:00
parent 1a68565ba0
commit f7590a7b8b
25 changed files with 1887 additions and 5 deletions
@@ -0,0 +1,60 @@
+name: Developer Meta-package Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  publish-package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.12"
+      - name: Validate protected release tag and package version
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          python - <<'PY'
+          import fnmatch
+          import json
+          import os
+          from pathlib import Path
+          import subprocess
+          import tomllib
+          import urllib.request
+
+          tag = os.environ["GITEA_REF_NAME"]
+          project = tomllib.loads(Path("packages/govoplan-meta/pyproject.toml").read_text(encoding="utf-8"))["project"]
+          if tag != f"v{project['version']}":
+              raise SystemExit("meta-package version does not match the release tag")
+          if subprocess.run(["git", "merge-base", "--is-ancestor", "HEAD", "origin/main"]).returncode:
+              raise SystemExit("release tag is not contained in main")
+          request = urllib.request.Request(
+              f"{os.environ['GITEA_API_URL']}/repos/{os.environ['GITEA_REPOSITORY']}/tag_protections",
+              headers={"Authorization": f"token {os.environ['GITEA_TOKEN']}"},
+          )
+          with urllib.request.urlopen(request, timeout=30) as response:
+              protections = json.load(response)
+          if not any(fnmatch.fnmatchcase(tag, item.get("name_pattern", "")) for item in protections):
+              raise SystemExit("release tag is not protected")
+          PY
+      - name: Build and publish developer package
+        env:
+          PACKAGE_USERNAME: ${{ secrets.GOVOPLAN_PACKAGE_USERNAME }}
+          PACKAGE_TOKEN: ${{ secrets.GOVOPLAN_PACKAGE_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "$PACKAGE_USERNAME"
+          test -n "$PACKAGE_TOKEN"
+          python -m pip install --disable-pip-version-check build==1.5.0 twine==7.0.0
+          python -m build --wheel --outdir dist packages/govoplan-meta
+          python -m twine check dist/*.whl
+          TWINE_USERNAME="$PACKAGE_USERNAME" TWINE_PASSWORD="$PACKAGE_TOKEN" \
+            python -m twine upload --non-interactive \
+              --repository-url https://git.add-ideas.de/api/packages/GovOPlaN/pypi \
+              dist/*.whl