release_publish.yml

name: "Release: Publish"
run-name: "Release: Publish ${{ inputs.tag || 'next pending release' }}"

on:
  schedule:
    # Check at 00:17, 06:17, 12:17, and 18:17 UTC.
    - cron: "17 */6 * * *"
  workflow_dispatch:
    inputs:
      tag:
        description: Specific pending release tag to check
        required: false
        type: string
      force_publish:
        description: Bypass Conda availability after release-gate approval (requires tag)
        required: false
        default: false
        type: boolean

concurrency:
  group: release

permissions:
  contents: read

jobs:
  CheckConda:
    if: github.repository == 'aws-deadline/deadline-cloud-for-cinema-4d'
    runs-on: ubuntu-latest
    outputs:
      ready: ${{ steps.readiness.outputs.ready }}
      tag: ${{ steps.readiness.outputs.tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Check release readiness
        id: readiness
        uses: aws-deadline/.github/.github/actions/check-release-readiness@mainline
        with:
          github-token: ${{ github.token }}
          requested-tag: ${{ inputs.tag }}
          force-publish: ${{ inputs.force_publish }}
          package-name: cinema4d-openjd
          required-platforms: linux-64,win-64
          timeout-days: 4

  ApproveManifestOverride:
    needs: CheckConda
    if: >-
      inputs.force_publish == true &&
      needs.CheckConda.outputs.tag != '' &&
      needs.CheckConda.outputs.ready != 'true'
    runs-on: ubuntu-latest
    environment: release-gate
    permissions: {}
    steps:
      - name: Record approved override
        env:
          TAG: ${{ needs.CheckConda.outputs.tag }}
        run: |
          echo "Conda manifest override approved for release $TAG."
          {
            echo "### Conda manifest override"
            echo
            printf 'Release `%s` was approved without a published Conda package.\n' "$TAG"
          } >> "$GITHUB_STEP_SUMMARY"

  AuthorizePublish:
    needs: [CheckConda, ApproveManifestOverride]
    if: >-
      always() &&
      needs.CheckConda.result == 'success' &&
      needs.CheckConda.outputs.tag != '' &&
      (
        needs.CheckConda.outputs.ready == 'true' ||
        needs.ApproveManifestOverride.result == 'success'
      )
    runs-on: ubuntu-latest
    permissions: {}
    outputs:
      tag: ${{ steps.release.outputs.tag }}
    steps:
      - name: Authorize public release
        id: release
        env:
          TAG: ${{ needs.CheckConda.outputs.tag }}
        run: echo "tag=$TAG" >> "$GITHUB_OUTPUT"

  ValidateRelease:
    needs: AuthorizePublish
    if: needs.AuthorizePublish.outputs.tag != ''
    uses: aws-deadline/.github/.github/workflows/reusable_tag_release.yml@mainline
    permissions:
      contents: read
    secrets: inherit
    with:
      tag: ${{ needs.AuthorizePublish.outputs.tag }}

  PreRelease:
    needs: ValidateRelease
    if: needs.ValidateRelease.outputs.tag != ''
    uses: aws-deadline/.github/.github/workflows/reusable_prerelease.yml@mainline
    permissions:
      id-token: write
      contents: write
    secrets: inherit
    with:
      tag: ${{ needs.ValidateRelease.outputs.tag }}

  ReleaseInstaller:
    needs: [ValidateRelease, PreRelease]
    if: needs.ValidateRelease.outputs.tag != ''
    uses: aws-deadline/.github/.github/workflows/reusable_release_installers.yml@mainline
    secrets: inherit
    permissions:
      id-token: write
      contents: read
    with:
      tag: ${{ needs.ValidateRelease.outputs.tag }}
      oses: "['Windows', 'MacOS']"
      project_name: ${{ github.event.repository.name }}

  # Create the completion marker before PyPI so scheduled retries cannot
  # repeatedly release installers. Recover PyPI by rerunning this run's failed job.
  Release:
    needs: [ValidateRelease, PreRelease, ReleaseInstaller]
    if: needs.ValidateRelease.outputs.tag != ''
    uses: aws-deadline/.github/.github/workflows/reusable_release.yml@mainline
    secrets: inherit
    permissions:
      id-token: write
      contents: write
    with:
      tag: ${{ needs.ValidateRelease.outputs.tag }}

  # PyPI does not support reusable workflows yet.
  # See https://github.com/pypi/warehouse/issues/11096
  PublishToPyPI:
    needs: [ValidateRelease, Release]
    if: needs.ValidateRelease.outputs.tag != ''
    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.ValidateRelease.outputs.tag }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ needs.ValidateRelease.outputs.build-python-version }}

      - name: Install dependencies
        run: pip install --upgrade hatch

      - name: Build
        run: hatch -v build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          skip-existing: true