release.yaml

# Copyright 2023 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Release Candidate

on:
  pull_request:
    types: [opened, synchronize, closed]
  # Allow workflow to be triggered manually.
  workflow_dispatch:

permissions:
  contents: read

jobs:
  stage_release:
    # To publish a release, merge the release PR with the label 'release:publish'.
    # To stage a release without publishing it, manually invoke the workflow.
    # .  or apply the 'release:stage' label to a PR.
    if: >
      (github.event.pull_request.merged && contains(github.event.pull_request.labels.*.name, 'release:publish')) ||
      github.event.workflow_dispatch ||
      (!github.event.pull_request.merged && contains(github.event.pull_request.labels.*.name, 'release:stage'))

    runs-on: ubuntu-latest

    steps:
    - name: Checkout source for staging
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        persist-credentials: false

    - name: Set up Python
      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
      with:
        python-version: '3.10'

    - name: Install uv
      uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3.2.4
      with:
        enable-cache: true

    - name: Install dependencies
      run: |
        uv sync --dev

    - name: Test with pytest & coverage
      run: |
        uv run pytest --cov=src --cov-report term --cov-report html --cov-report xml -vv

    # Build the Python Wheel and the source distribution.
    - name: Package release artifacts
      run: |
       uv run python -m build

    # Attach the packaged artifacts to the workflow output. These can be manually
    # downloaded for later inspection if necessary.
    - name: Archive artifacts
      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
      with:
        name: dist
        path: dist/

  publish_release:
    needs: stage_release

    # Check whether the release should be published. We publish only when the trigger PR is
    #   1. merged
    #   2. to the main branch
    #   3. with the label 'release:publish', and
    #   4. the title prefix 'chore: Release '.
    if: >
      github.event.pull_request.merged &&
      github.ref == 'refs/heads/main' &&
      contains(github.event.pull_request.labels.*.name, 'release:publish') &&
      startsWith(github.event.pull_request.title, 'chore: Release ')

    runs-on: ubuntu-latest

    permissions:
      # Used to create a short-lived OIDC token which is given to PyPi to identify this workflow job
      # See: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
      # and https://docs.pypi.org/trusted-publishers/using-a-publisher/
      id-token: write
      contents: write

    steps:
    - name: Checkout source for publish
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        persist-credentials: false

    # Download the artifacts created by the stage_release job.
    - name: Download release candidates
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      with:
        name: dist
        path: dist

    - name: Publish preflight check
      id: preflight
      run: ./.github/scripts/publish_preflight_check.sh

      # We pull this action from a custom fork of a contributor until
      # https://github.com/actions/create-release/pull/32 is merged. Also note that v1 of
      # this action does not support the "body" parameter.
    - name: Create release tag
      # Skip creating a release tag for prereleases
      if: (!contains(github.event.pull_request.labels.*.name, 'release:prerelease'))
      uses: fleskesvor/create-release@1a72e235c178bf2ae6c51a8ae36febc24568c5fe # zizmor: ignore[unpinned-uses]
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        tag_name: ${{ steps.preflight.outputs.version }}
        release_name: Firebase Functions Python SDK ${{ steps.preflight.outputs.version }}
        body: ${{ steps.preflight.outputs.changelog }}
        draft: false
        prerelease: false

    - name: Publish to Pypi
      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2