release.yml

# Based on https://python-semantic-release.readthedocs.io/en/latest/configuration/configuration-guides/monorepos.html

name: Continuous Delivery

on:
  push:
    branches:
      - main

# default: least privileged permissions across all jobs
permissions:
  contents: read

jobs:
  release-runtime-sdk:
    runs-on: ubuntu-latest
    concurrency:
      group: ${{ github.workflow }}-release-runtime-sdk-${{ github.ref_name }}
      cancel-in-progress: false

    outputs:
      released: ${{ steps.release.outputs.released }}
      tag: ${{ steps.release.outputs.tag }}

    permissions:
      contents: write

    steps:
      # Note: We checkout the repository at the branch that triggered the workflow
      # with the entire history to ensure to match PSR's release branch detection
      # and history evaluation.
      # However, we forcefully reset the branch to the workflow sha because it is
      # possible that the branch was updated while the workflow was running. This
      # prevents accidentally releasing un-evaluated changes.
      - name: Setup | Checkout Repository on Release Branch
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.DEVPROD_PAT }}
          ref: main
          fetch-depth: 0

      - name: Setup | Force release branch to be at workflow sha
        run: |
          git reset --hard ${{ github.sha }}

      - name: Evaluate | Verify upstream has NOT changed
        shell: bash
        run: |
          set +o pipefail

          UPSTREAM_BRANCH_NAME="$(git status -sb | head -n 1 | cut -d' ' -f2 | grep -E '\.{3}' | cut -d'.' -f4)"
          printf '%s\n' "Upstream branch name: $UPSTREAM_BRANCH_NAME"

          set -o pipefail

          if [ -z "$UPSTREAM_BRANCH_NAME" ]; then
              printf >&2 '%s\n' "::error::Unable to determine upstream branch name!"
              exit 1
          fi

          git fetch "${UPSTREAM_BRANCH_NAME%%/*}"

          if ! UPSTREAM_SHA="$(git rev-parse "$UPSTREAM_BRANCH_NAME")"; then
              printf >&2 '%s\n' "::error::Unable to determine upstream branch sha!"
              exit 1
          fi

          HEAD_SHA="$(git rev-parse HEAD)"

          if [ "$HEAD_SHA" != "$UPSTREAM_SHA" ]; then
              printf >&2 '%s\n' "[HEAD SHA] $HEAD_SHA != $UPSTREAM_SHA [UPSTREAM SHA]"
              printf >&2 '%s\n' "::error::Upstream has changed, aborting release..."
              exit 1
          fi

          printf '%s\n' "Verified upstream branch has not changed, continuing with release..."

      - name: Action | Semantic Version Release
        id: release
        uses: python-semantic-release/python-semantic-release@v10.5.3
        with:
          github_token: ${{ secrets.DEVPROD_PAT }}
          git_committer_name: "Workers DevProd"
          git_committer_email: "workers-devprod@cloudflare.com"
          directory: packages/runtime-sdk

      - name: Publish | Upload to GitHub Release Assets
        uses: python-semantic-release/publish-action@v10.5.3
        if: steps.release.outputs.released == 'true'
        with:
          github_token: ${{ secrets.DEVPROD_PAT }}
          tag: ${{ steps.release.outputs.tag }}
          directory: packages/runtime-sdk

      - name: Upload | Distribution Artifacts
        uses: actions/upload-artifact@v4
        if: steps.release.outputs.released == 'true'
        with:
          name: distribution-artifacts-workers-runtime-sdk
          path: packages/runtime-sdk/dist
          if-no-files-found: error

  release-cli:
    runs-on: ubuntu-latest
    needs: release-runtime-sdk
    # Run even if SDK had nothing to release (but not if it errored)
    if: always() && (needs.release-runtime-sdk.result == 'success')
    concurrency:
      group: ${{ github.workflow }}-release-cli-${{ github.ref_name }}
      cancel-in-progress: false

    outputs:
      released: ${{ steps.release.outputs.released }}
      tag: ${{ steps.release.outputs.tag }}

    permissions:
      contents: write

    steps:
      # Checkout latest ref (may include SDK's version commit)
      - name: Setup | Checkout Repository on Release Branch
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.DEVPROD_PAT }}
          ref: main
          fetch-depth: 0

      - name: Action | Semantic Version Release
        id: release
        uses: python-semantic-release/python-semantic-release@v10.5.3
        with:
          github_token: ${{ secrets.DEVPROD_PAT }}
          git_committer_name: "Workers DevProd"
          git_committer_email: "workers-devprod@cloudflare.com"
          directory: packages/cli

      - name: Publish | Upload to GitHub Release Assets
        uses: python-semantic-release/publish-action@v10.5.3
        if: steps.release.outputs.released == 'true'
        with:
          github_token: ${{ secrets.DEVPROD_PAT }}
          tag: ${{ steps.release.outputs.tag }}
          directory: packages/cli

      - name: Upload | Distribution Artifacts
        uses: actions/upload-artifact@v4
        if: steps.release.outputs.released == 'true'
        with:
          name: distribution-artifacts-workers-py
          path: packages/cli/dist
          if-no-files-found: error

  release-django-cf:
    runs-on: ubuntu-latest
    needs: release-cli
    # django-cf depends on neither of the other packages, but every PSR job pushes
    # a version bump to main, so the jobs are serialized to avoid racing on push.
    if: always() && (needs.release-cli.result == 'success')
    concurrency:
      group: ${{ github.workflow }}-release-django-cf-${{ github.ref_name }}
      cancel-in-progress: false

    outputs:
      released: ${{ steps.release.outputs.released }}
      tag: ${{ steps.release.outputs.tag }}

    permissions:
      contents: write

    steps:
      # Checkout latest ref (may include the preceding jobs' version commits)
      - name: Setup | Checkout Repository on Release Branch
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.DEVPROD_PAT }}
          ref: main
          fetch-depth: 0

      - name: Action | Semantic Version Release
        id: release
        uses: python-semantic-release/python-semantic-release@v10.5.3
        with:
          github_token: ${{ secrets.DEVPROD_PAT }}
          git_committer_name: "Workers DevProd"
          git_committer_email: "workers-devprod@cloudflare.com"
          directory: packages/django-cf

      - name: Publish | Upload to GitHub Release Assets
        uses: python-semantic-release/publish-action@v10.5.3
        if: steps.release.outputs.released == 'true'
        with:
          github_token: ${{ secrets.DEVPROD_PAT }}
          tag: ${{ steps.release.outputs.tag }}
          directory: packages/django-cf

      - name: Upload | Distribution Artifacts
        uses: actions/upload-artifact@v4
        if: steps.release.outputs.released == 'true'
        with:
          name: distribution-artifacts-django-cf
          path: packages/django-cf/dist
          if-no-files-found: error

  deploy:
    runs-on: ubuntu-latest
    needs: [release-runtime-sdk, release-cli, release-django-cf]
    if: always() && (needs.release-runtime-sdk.outputs.released == 'true' || needs.release-cli.outputs.released == 'true' || needs.release-django-cf.outputs.released == 'true')

    permissions:
      contents: read
      id-token: write

    steps:
      - name: Setup | Download Build Artifacts
        uses: actions/download-artifact@v4
        id: artifact-download
        with:
          pattern: distribution-artifacts-*
          path: dist
          merge-multiple: true

      # see https://docs.pypi.org/trusted-publishers/
      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist
          print-hash: true
          verbose: true