Skip to content

Commit b07b13f

Browse files
karthikbekalpkarthikbekalp
committed
ci: split release preparation and publishing
Signed-off-by: Karthik Bekal Pattathana <133984042+karthikbekalp@users.noreply.github.com>
1 parent 5b6db61 commit b07b13f

2 files changed

Lines changed: 210 additions & 118 deletions

File tree

‎.github/workflows/release_prepare.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
name: "Release: Prepare"
2+
run-name: "Release: Prepare ${{ github.event.head_commit.message || inputs.tag }}"
3+
4+
on:
5+
push:
6+
branches:
7+
- mainline
8+
paths:
9+
- CHANGELOG.md
10+
workflow_dispatch:
11+
inputs:
12+
tag:
13+
required: true
14+
type: string
15+
description: Specify a tag to re-run a release.
16+
17+
concurrency:
18+
group: release
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
TagRelease:
25+
uses: aws-deadline/.github/.github/workflows/reusable_tag_release.yml@mainline
26+
secrets: inherit
27+
with:
28+
tag: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || '' }}
29+
30+
UnitTests:
31+
needs: [TagRelease]
32+
name: Unit Tests
33+
uses: ./.github/workflows/code_quality.yml
34+
with:
35+
tag: ${{ needs.TagRelease.outputs.tag }}
36+
37+
Xa11yWindows:
38+
needs: [TagRelease, UnitTests]
39+
name: xa11y Integration Tests (Windows, Cinema 4D ${{ matrix.c4d_version }})
40+
strategy:
41+
fail-fast: false
42+
matrix:
43+
c4d_version: ["2024", "2025", "2026"]
44+
uses: ./.github/workflows/integ_windows.yml
45+
with:
46+
c4d_version: ${{ matrix.c4d_version }}
47+
secrets:
48+
AWS_OIDC_ROLE_ARN: ${{ secrets.AWS_OIDC_ROLE_ARN }}
49+
AWS_REGION: ${{ secrets.AWS_REGION }}
50+
RLM_PORT: ${{ secrets.RLM_PORT }}
51+
INSTALLER_BUCKET: ${{ secrets.INSTALLER_BUCKET }}
52+
INSTALLER_BUCKET_EXPECTED_OWNER: ${{ secrets.INSTALLER_BUCKET_EXPECTED_OWNER }}
53+
LICENSE_ROLE_ARN: ${{ secrets.LICENSE_ROLE_ARN }}
54+
BASTION_INSTANCE_TAG: ${{ secrets.BASTION_INSTANCE_TAG }}
55+
permissions:
56+
id-token: write
57+
contents: read
58+
59+
Xa11yMacOS:
60+
needs: [TagRelease, UnitTests]
61+
name: xa11y Integration Tests (macOS, Cinema 4D ${{ matrix.c4d_version }})
62+
strategy:
63+
fail-fast: false
64+
matrix:
65+
c4d_version: ["2024", "2025", "2026"]
66+
uses: ./.github/workflows/integ_macos.yml
67+
with:
68+
c4d_version: ${{ matrix.c4d_version }}
69+
secrets:
70+
AWS_OIDC_ROLE_ARN: ${{ secrets.AWS_OIDC_ROLE_ARN }}
71+
AWS_REGION: ${{ secrets.AWS_REGION }}
72+
RLM_PORT: ${{ secrets.RLM_PORT }}
73+
INSTALLER_BUCKET: ${{ secrets.INSTALLER_BUCKET }}
74+
INSTALLER_BUCKET_EXPECTED_OWNER: ${{ secrets.INSTALLER_BUCKET_EXPECTED_OWNER }}
75+
LICENSE_ROLE_ARN: ${{ secrets.LICENSE_ROLE_ARN }}
76+
BASTION_INSTANCE_TAG: ${{ secrets.BASTION_INSTANCE_TAG }}
77+
permissions:
78+
id-token: write
79+
contents: read
80+
81+
BuildInstaller:
82+
needs: [TagRelease, UnitTests, Xa11yWindows, Xa11yMacOS]
83+
uses: aws-deadline/.github/.github/workflows/reusable_build_installers.yml@mainline
84+
secrets: inherit
85+
permissions:
86+
id-token: write
87+
contents: read
88+
with:
89+
ref_type: tags
90+
ref: ${{ needs.TagRelease.outputs.tag }}
91+
oses: "['Windows', 'MacOS']"
92+
environment: release
93+
project_name: ${{ github.event.repository.name }}
94+
95+
PublishToCodeArtifact:
96+
needs: [TagRelease, BuildInstaller]
97+
uses: aws-deadline/.github/.github/workflows/reusable_publish_python.yml@mainline
98+
permissions:
99+
id-token: write
100+
secrets: inherit
101+
with:
102+
tag: ${{ needs.TagRelease.outputs.tag }}

‎.github/workflows/release_publish.yml‎

Lines changed: 108 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,21 @@
11
name: "Release: Publish"
2-
run-name: "Release: ${{ github.event.head_commit.message || inputs.tag }}"
2+
run-name: "Release: Publish ${{ inputs.tag || 'next pending release' }}"
33

44
on:
5-
push:
6-
branches:
7-
- mainline
8-
paths:
9-
- CHANGELOG.md
5+
schedule:
6+
# Check at 00:17, 06:17, 12:17, and 18:17 UTC.
7+
- cron: "17 */6 * * *"
108
workflow_dispatch:
119
inputs:
1210
tag:
13-
required: true
11+
description: Specific pending release tag to check
12+
required: false
1413
type: string
15-
description: Specify a tag to re-run a release.
14+
force_publish:
15+
description: Bypass Conda availability after release-gate approval (requires tag)
16+
required: false
17+
default: false
18+
type: boolean
1619

1720
concurrency:
1821
group: release
@@ -21,150 +24,137 @@ permissions:
2124
contents: read
2225

2326
jobs:
24-
TagRelease:
25-
uses: aws-deadline/.github/.github/workflows/reusable_tag_release.yml@mainline
26-
secrets: inherit
27-
with:
28-
tag: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || '' }}
27+
CheckConda:
28+
if: github.repository == 'aws-deadline/deadline-cloud-for-cinema-4d'
29+
runs-on: ubuntu-latest
30+
outputs:
31+
ready: ${{ steps.readiness.outputs.ready }}
32+
tag: ${{ steps.readiness.outputs.tag }}
33+
steps:
34+
- name: Checkout
35+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
36+
with:
37+
fetch-depth: 0
38+
persist-credentials: false
2939

30-
UnitTests:
31-
needs: [TagRelease]
32-
name: Unit Tests
33-
uses: ./.github/workflows/code_quality.yml
34-
with:
35-
tag: ${{ needs.TagRelease.outputs.tag }}
40+
- name: Check release readiness
41+
id: readiness
42+
uses: aws-deadline/.github/.github/actions/check-release-readiness@mainline
43+
with:
44+
github-token: ${{ github.token }}
45+
requested-tag: ${{ inputs.tag }}
46+
force-publish: ${{ inputs.force_publish }}
47+
package-name: cinema4d-openjd
48+
required-platforms: linux-64,win-64
49+
timeout-days: 4
3650

37-
Xa11yWindows:
38-
needs: [TagRelease, UnitTests]
39-
name: xa11y Integration Tests (Windows, Cinema 4D ${{ matrix.c4d_version }})
40-
strategy:
41-
fail-fast: false
42-
matrix:
43-
c4d_version: ["2024", "2025", "2026"]
44-
uses: ./.github/workflows/integ_windows.yml
45-
with:
46-
c4d_version: ${{ matrix.c4d_version }}
47-
secrets:
48-
AWS_OIDC_ROLE_ARN: ${{ secrets.AWS_OIDC_ROLE_ARN }}
49-
AWS_REGION: ${{ secrets.AWS_REGION }}
50-
RLM_PORT: ${{ secrets.RLM_PORT }}
51-
INSTALLER_BUCKET: ${{ secrets.INSTALLER_BUCKET }}
52-
INSTALLER_BUCKET_EXPECTED_OWNER: ${{ secrets.INSTALLER_BUCKET_EXPECTED_OWNER }}
53-
LICENSE_ROLE_ARN: ${{ secrets.LICENSE_ROLE_ARN }}
54-
BASTION_INSTANCE_TAG: ${{ secrets.BASTION_INSTANCE_TAG }}
55-
permissions:
56-
id-token: write
57-
contents: read
51+
ApproveManifestOverride:
52+
needs: CheckConda
53+
if: >-
54+
inputs.force_publish == true &&
55+
needs.CheckConda.outputs.tag != '' &&
56+
needs.CheckConda.outputs.ready != 'true'
57+
runs-on: ubuntu-latest
58+
environment: release-gate
59+
permissions: {}
60+
steps:
61+
- name: Record approved override
62+
env:
63+
TAG: ${{ needs.CheckConda.outputs.tag }}
64+
run: |
65+
echo "Conda manifest override approved for release $TAG."
66+
{
67+
echo "### Conda manifest override"
68+
echo
69+
printf 'Release `%s` was approved without a published Conda package.\n' "$TAG"
70+
} >> "$GITHUB_STEP_SUMMARY"
5871
59-
Xa11yMacOS:
60-
needs: [TagRelease, UnitTests]
61-
name: xa11y Integration Tests (macOS, Cinema 4D ${{ matrix.c4d_version }})
62-
strategy:
63-
fail-fast: false
64-
matrix:
65-
c4d_version: ["2024", "2025", "2026"]
66-
uses: ./.github/workflows/integ_macos.yml
67-
with:
68-
c4d_version: ${{ matrix.c4d_version }}
69-
secrets:
70-
AWS_OIDC_ROLE_ARN: ${{ secrets.AWS_OIDC_ROLE_ARN }}
71-
AWS_REGION: ${{ secrets.AWS_REGION }}
72-
RLM_PORT: ${{ secrets.RLM_PORT }}
73-
INSTALLER_BUCKET: ${{ secrets.INSTALLER_BUCKET }}
74-
INSTALLER_BUCKET_EXPECTED_OWNER: ${{ secrets.INSTALLER_BUCKET_EXPECTED_OWNER }}
75-
LICENSE_ROLE_ARN: ${{ secrets.LICENSE_ROLE_ARN }}
76-
BASTION_INSTANCE_TAG: ${{ secrets.BASTION_INSTANCE_TAG }}
77-
permissions:
78-
id-token: write
79-
contents: read
72+
AuthorizePublish:
73+
needs: [CheckConda, ApproveManifestOverride]
74+
if: >-
75+
always() &&
76+
needs.CheckConda.result == 'success' &&
77+
needs.CheckConda.outputs.tag != '' &&
78+
(
79+
needs.CheckConda.outputs.ready == 'true' ||
80+
needs.ApproveManifestOverride.result == 'success'
81+
)
82+
runs-on: ubuntu-latest
83+
permissions: {}
84+
outputs:
85+
tag: ${{ steps.release.outputs.tag }}
86+
steps:
87+
- name: Authorize public release
88+
id: release
89+
env:
90+
TAG: ${{ needs.CheckConda.outputs.tag }}
91+
run: echo "tag=$TAG" >> "$GITHUB_OUTPUT"
8092

8193
PreRelease:
82-
needs: [TagRelease, UnitTests, Xa11yWindows, Xa11yMacOS]
83-
uses: aws-deadline/.github/.github/workflows/reusable_prerelease.yml@mainline
84-
permissions:
85-
id-token: write
86-
contents: write
87-
secrets: inherit
88-
with:
89-
tag: ${{ needs.TagRelease.outputs.tag }}
90-
91-
BuildInstaller:
92-
needs: [TagRelease, PreRelease]
93-
uses: aws-deadline/.github/.github/workflows/reusable_build_installers.yml@mainline
94-
secrets: inherit
94+
needs: AuthorizePublish
95+
if: needs.AuthorizePublish.outputs.tag != ''
96+
uses: aws-deadline/.github/.github/workflows/reusable_prerelease.yml@mainline
9597
permissions:
9698
id-token: write
97-
contents: read
99+
contents: write
100+
secrets: inherit
98101
with:
99-
ref_type: tags
100-
ref: ${{ needs.TagRelease.outputs.tag }}
101-
oses: "['Windows', 'MacOS']"
102-
environment: release
103-
project_name: ${{ github.event.repository.name }}
102+
tag: ${{ needs.AuthorizePublish.outputs.tag }}
104103

105-
Publish:
106-
needs: [TagRelease, BuildInstaller]
107-
uses: aws-deadline/.github/.github/workflows/reusable_publish_python.yml@mainline
108-
permissions:
109-
id-token: write
110-
secrets: inherit
111-
with:
112-
tag: ${{ needs.TagRelease.outputs.tag }}
113-
114-
IsCondaReady:
115-
needs: Publish
116-
runs-on: ubuntu-latest
117-
environment: release-gate
118-
name: “Is the Conda Package available in all ProdWaves and have you ran any required manual tests?”
119-
steps:
120-
- run: |
121-
:
122-
123104
ReleaseInstaller:
124-
needs: [TagRelease, IsCondaReady]
105+
needs: [AuthorizePublish, PreRelease]
106+
if: needs.AuthorizePublish.outputs.tag != ''
125107
uses: aws-deadline/.github/.github/workflows/reusable_release_installers.yml@mainline
126108
secrets: inherit
127109
permissions:
128110
id-token: write
129111
contents: read
130112
with:
131-
tag: ${{ needs.TagRelease.outputs.tag }}
113+
tag: ${{ needs.AuthorizePublish.outputs.tag }}
132114
oses: "['Windows', 'MacOS']"
133115
project_name: ${{ github.event.repository.name }}
134116

135-
Release:
136-
needs: [TagRelease, ReleaseInstaller]
137-
uses: aws-deadline/.github/.github/workflows/reusable_release.yml@mainline
138-
secrets: inherit
139-
permissions:
140-
id-token: write
141-
contents: write
142-
with:
143-
tag: ${{ needs.TagRelease.outputs.tag }}
144-
145-
# PyPI does not support reusable workflows yet
146-
# # See https://github.com/pypi/warehouse/issues/11096
117+
# PyPI does not support reusable workflows yet.
118+
# See https://github.com/pypi/warehouse/issues/11096
147119
PublishToPyPI:
148-
needs: [TagRelease, Release]
120+
needs: [AuthorizePublish, ReleaseInstaller]
121+
if: needs.AuthorizePublish.outputs.tag != ''
149122
runs-on: ubuntu-latest
150123
environment: release
151124
permissions:
152125
id-token: write
126+
contents: read
153127
steps:
154128
- name: Checkout
155129
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
156130
with:
157-
ref: ${{ needs.TagRelease.outputs.tag }}
131+
ref: ${{ needs.AuthorizePublish.outputs.tag }}
158132
fetch-depth: 0
133+
persist-credentials: false
134+
159135
- name: Set up Python
160136
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
161137
with:
162-
python-version: ${{ needs.TagRelease.outputs.build-python-version }}
138+
python-version: "3.13"
139+
163140
- name: Install dependencies
164-
run: |
165-
pip install --upgrade hatch
141+
run: pip install --upgrade hatch
142+
166143
- name: Build
167144
run: hatch -v build
168-
# # See https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-pypi
145+
169146
- name: Publish to PyPI
170147
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
148+
with:
149+
skip-existing: true
150+
151+
Release:
152+
needs: [AuthorizePublish, PreRelease, PublishToPyPI]
153+
if: needs.AuthorizePublish.outputs.tag != ''
154+
uses: aws-deadline/.github/.github/workflows/reusable_release.yml@mainline
155+
secrets: inherit
156+
permissions:
157+
id-token: write
158+
contents: write
159+
with:
160+
tag: ${{ needs.AuthorizePublish.outputs.tag }}

0 commit comments

Comments
 (0)