Skip to content

Commit f83fc93

Browse files
blink1073blink1073
authored
INTPYTHON-582 Add release workflows (#9)
* INTPYTHON-585 Add release workflows
1 parent e66a1cf commit f83fc93

File tree

10 files changed

+535
-0
lines changed

10 files changed

+535
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
version: 2
2+
updates:
3+
# GitHub Actions
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
cooldown:
9+
default-days: 7
10+
groups:
11+
actions:
12+
patterns:
13+
- "*"
14+
# Python
15+
- package-ecosystem: "pip"
16+
directory: "/"
17+
schedule:
18+
interval: "weekly"
19+
cooldown:
20+
default-days: 7

‎.github/workflows/dist-python.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Python Dist
2+
3+
on:
4+
push:
5+
tags:
6+
- "[0-9]+.[0-9]+.[0-9]+"
7+
- "[0-9]+.[0-9]+.[0-9]+.post[0-9]+"
8+
- "[0-9]+.[0-9]+.[0-9]+[a-b][0-9]+"
9+
- "[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
10+
workflow_dispatch:
11+
pull_request:
12+
workflow_call:
13+
inputs:
14+
ref:
15+
required: true
16+
type: string
17+
18+
concurrency:
19+
group: dist-${{ github.ref }}
20+
cancel-in-progress: true
21+
22+
defaults:
23+
run:
24+
shell: bash -eux {0}
25+
26+
jobs:
27+
make_dist:
28+
name: Make Dist
29+
runs-on: macos-latest
30+
permissions:
31+
contents: write
32+
steps:
33+
- uses: actions/checkout@v5
34+
with:
35+
persist-credentials: false
36+
37+
- uses: actions/setup-python@v6
38+
with:
39+
# Build sdist on lowest supported Python
40+
python-version: '3.10'
41+
42+
- name: Install python requirements
43+
run: |
44+
python -m pip install uv rust-just build twine
45+
46+
- name: Build Dist
47+
run: |
48+
python -m build .
49+
50+
- name: Test SDist
51+
run: |
52+
python -m twine check --strict dist/*.*
53+
python -m pip install dist/*.gz
54+
cd ..
55+
python -c "import django_mongodb_extensions"
56+
57+
- uses: actions/upload-artifact@v4
58+
with:
59+
name: "dist"
60+
path: ./dist/*.*
61+
62+
collect_dist:
63+
runs-on: ubuntu-latest
64+
needs: [make_dist]
65+
name: Download Dist
66+
permissions:
67+
contents: read
68+
steps:
69+
- name: Download all workflow run artifacts
70+
uses: actions/download-artifact@v5
71+
- name: Flatten directory
72+
working-directory: .
73+
run: |
74+
find . -mindepth 2 -type f -exec mv {} . \;
75+
find . -type d -empty -delete
76+
- uses: actions/upload-artifact@v4
77+
with:
78+
name: all-dist-${{ github.run_id }}
79+
path: "./*"

‎.github/workflows/release-python.yml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: Release
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
following_version:
7+
description: "The post (dev) version to set"
8+
dry_run:
9+
description: "Dry Run?"
10+
default: false
11+
type: boolean
12+
schedule:
13+
- cron: '30 5 * * *'
14+
15+
env:
16+
# Changes per repo
17+
PRODUCT_NAME: django-mongodb-extensions
18+
# Constant
19+
# inputs will be empty on a scheduled run. so, we only set dry_run
20+
# to 'false' when the input is set to 'false'.
21+
DRY_RUN: ${{ ! contains(inputs.dry_run, 'false') }}
22+
FOLLOWING_VERSION: ${{ inputs.following_version || '' }}
23+
24+
concurrency:
25+
group: release-${{ github.ref }}
26+
cancel-in-progress: true
27+
28+
defaults:
29+
run:
30+
shell: bash -eux {0}
31+
32+
jobs:
33+
pre-publish:
34+
environment: release
35+
runs-on: ubuntu-latest
36+
if: github.repository_owner == 'mongodb-labs' || github.event_name == 'workflow_dispatch'
37+
permissions:
38+
id-token: write
39+
contents: write
40+
outputs:
41+
version: ${{ steps.pre-publish.outputs.version }}
42+
steps:
43+
- uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
44+
with:
45+
app_id: ${{ vars.APP_ID }}
46+
private_key: ${{ secrets.APP_PRIVATE_KEY }}
47+
- uses: mongodb-labs/drivers-github-tools/setup@v3
48+
with:
49+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
50+
aws_region_name: ${{ vars.AWS_REGION_NAME }}
51+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
52+
- uses: mongodb-labs/drivers-github-tools/python-labs/pre-publish@v3
53+
id: pre-publish
54+
with:
55+
dry_run: ${{ env.DRY_RUN }}
56+
57+
build-dist:
58+
needs: [pre-publish]
59+
uses: ./.github/workflows/dist-python.yml
60+
permissions:
61+
contents: write
62+
with:
63+
ref: ${{ needs.pre-publish.outputs.version }}
64+
65+
publish:
66+
# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#publishing-the-distribution-to-pypi
67+
needs: [build-dist]
68+
if: (github.repository_owner == 'mongodb-labs' && github.event_name != 'pull_request') || github.event_name == 'workflow_dispatch'
69+
runs-on: ubuntu-latest
70+
environment: release
71+
permissions:
72+
id-token: write
73+
steps:
74+
- name: Download all the dists
75+
uses: actions/download-artifact@v5
76+
with:
77+
name: all-dist-${{ github.run_id }}
78+
path: dist/
79+
- name: Publish distribution 📦 to PyPI
80+
if: startsWith(env.DRY_RUN, 'false')
81+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
82+
83+
post-publish:
84+
needs: [publish]
85+
runs-on: ubuntu-latest
86+
environment: release
87+
permissions:
88+
id-token: write
89+
contents: write
90+
attestations: write
91+
security-events: write
92+
steps:
93+
- uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
94+
with:
95+
app_id: ${{ vars.APP_ID }}
96+
private_key: ${{ secrets.APP_PRIVATE_KEY }}
97+
- uses: mongodb-labs/drivers-github-tools/setup@v3
98+
with:
99+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
100+
aws_region_name: ${{ vars.AWS_REGION_NAME }}
101+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
102+
- uses: mongodb-labs/drivers-github-tools/python-labs/post-publish@v3
103+
with:
104+
following_version: ${{ env.FOLLOWING_VERSION }}
105+
product_name: ${{ env.PRODUCT_NAME }}
106+
token: ${{ github.token }}
107+
dry_run: ${{ env.DRY_RUN }}

‎.github/workflows/test-python.yml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
name: Python Tests
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
8+
concurrency:
9+
group: tests-${{ github.ref }}
10+
cancel-in-progress: true
11+
12+
defaults:
13+
run:
14+
shell: bash -eux {0}
15+
16+
permissions:
17+
contents: read
18+
19+
env:
20+
MIN_PYTHON: "3.10"
21+
MIN_MONGODB: "6.0"
22+
MAX_MONGODB: "8.0"
23+
24+
jobs:
25+
static:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- uses: actions/checkout@v5
29+
with:
30+
persist-credentials: false
31+
fetch-depth: 0
32+
- name: Install uv
33+
uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7
34+
with:
35+
enable-cache: true
36+
python-version: ${{ matrix.python-version }}
37+
- uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
38+
- run: just lint
39+
build:
40+
runs-on: ${{ matrix.os }}
41+
strategy:
42+
matrix:
43+
os: ["ubuntu-latest"]
44+
python-version: ["3.10", "3.11", "3.12", "3.13"]
45+
fail-fast: false
46+
name: CPython ${{ matrix.python-version }}-${{ matrix.os }}
47+
steps:
48+
- uses: actions/checkout@v5
49+
with:
50+
persist-credentials: false
51+
fetch-depth: 0
52+
- name: Install uv
53+
uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7
54+
with:
55+
enable-cache: true
56+
python-version: ${{ matrix.python-version }}
57+
- uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
58+
- name: Start MongoDB on Linux
59+
if: ${{ startsWith(runner.os, 'Linux') }}
60+
uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0
61+
with:
62+
mongodb-version: ${{ env.MAX_MONGODB }}
63+
mongodb-replica-set: test-rs
64+
- run: just test
65+
66+
build-min:
67+
runs-on: ubuntu-latest
68+
steps:
69+
- uses: actions/checkout@v5
70+
with:
71+
persist-credentials: false
72+
fetch-depth: 0
73+
- name: Install uv
74+
uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7
75+
with:
76+
enable-cache: true
77+
python-version: ${{ env.MIN_PYTHON }}
78+
- uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
79+
- name: Install uv
80+
uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7
81+
with:
82+
enable-cache: true
83+
python-version: ${{ env.MIN_PYTHON }}
84+
- uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
85+
- uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0
86+
with:
87+
mongodb-version: ${{ env.MIN_MONGODB }}
88+
mongodb-replica-set: test-rs
89+
- name: Run unit tests with minimum dependency versions
90+
run: |
91+
uv sync --python=${MIN_PYTHON} --resolution=lowest-direct
92+
just test

‎.github/workflows/zizmor.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: GitHub Actions Security Analysis with zizmor 🌈
2+
3+
on:
4+
push:
5+
branches: ["master"]
6+
pull_request:
7+
branches: ["**"]
8+
9+
jobs:
10+
zizmor:
11+
name: zizmor latest via Cargo
12+
runs-on: ubuntu-latest
13+
permissions:
14+
security-events: write
15+
steps:
16+
- name: Checkout repository
17+
uses: actions/checkout@v5
18+
with:
19+
persist-credentials: false
20+
- name: Run zizmor 🌈
21+
uses: zizmorcore/zizmor-action@da5ac40c5419dcf7f21630fb2f95e725ae8fb9d5

0 commit comments

Comments
 (0)