Add registry-backed module package releases

.gitea/workflows/runtime-distribution.yml

@@ -101,12 +101,27 @@ jobs:
         run: python tools/repo/bootstrap-repositories.py --parent .. --transport public-https --reuse-checkout-auth --exclude-repo addideas-govoplan-website
       - name: Build release wheel roots and WebUI
         working-directory: govoplan
+        env:
+          VERSION: ${{ inputs.version }}
+          GOVOPLAN_PACKAGE_USERNAME: ${{ secrets.GOVOPLAN_PACKAGE_USERNAME }}
+          GOVOPLAN_PACKAGE_TOKEN: ${{ secrets.GOVOPLAN_PACKAGE_TOKEN }}
         run: |
           python -m venv .runtime-build
-          .runtime-build/bin/python -m pip install --upgrade pip wheel cryptography
-          mkdir -p runtime-output/local-wheels
-          .runtime-build/bin/python -m pip wheel --no-deps --wheel-dir runtime-output/local-wheels --requirement requirements-release.txt
-          bash tools/release/install-webui-release-dependencies.sh ../govoplan-core/webui
+          .runtime-build/bin/python -m pip install --upgrade pip cryptography
+          .runtime-build/bin/python tools/release/generate-release-package-set.py \
+            --version "$VERSION" \
+            --output runtime-output/release-packages.json
+          .runtime-build/bin/python tools/release/resolve-package-artifacts.py \
+            --package-set runtime-output/release-packages.json \
+            --wheelhouse runtime-output/local-wheels \
+            --webui-packages runtime-output/webui-packages \
+            --lock-output runtime-output/package-artifacts.lock.json \
+            --requirements-output runtime-output/requirements-release.packages.txt \
+            --python .runtime-build/bin/python
+          PYTHON=.runtime-build/bin/python \
+            GOVOPLAN_WEBUI_PACKAGE_LOCK="$PWD/runtime-output/package-artifacts.lock.json" \
+            GOVOPLAN_WEBUI_PACKAGE_DIR="$PWD/runtime-output/webui-packages" \
+            bash tools/release/install-webui-release-dependencies.sh ../govoplan-core/webui
           npm --prefix ../govoplan-core/webui run build
           .runtime-build/bin/python tools/release/prepare-runtime-context.py \
             --wheelhouse runtime-output/local-wheels \
@@ -264,6 +279,7 @@ jobs:
             --web-metadata runtime-output/web-metadata.json \
             --deployer runtime-output/govoplan-deploy.pyz \
             --deployer-url "$ARTIFACT_BASE/govoplan-deploy.pyz" \
+            --package-lock runtime-output/package-artifacts.lock.json \
             --artifact-base-url "$ARTIFACT_BASE" \
             --source-commit "$SOURCE_COMMIT" \
             --version "$VERSION" \
@@ -361,6 +377,9 @@ jobs:
             --asset runtime-output/distribution-manifest.json.sha256 \
             --asset runtime-output/distribution-keyring.json \
             --asset runtime-output/context-amd64/composition.json \
+            --asset runtime-output/release-packages.json \
+            --asset runtime-output/package-artifacts.lock.json \
+            --asset runtime-output/requirements-release.packages.txt \
             --asset runtime-output/evidence/api-sbom.cdx.json \
             --asset runtime-output/evidence/web-sbom.cdx.json \
             --asset runtime-output/evidence/api-provenance.json \