release-all.yml

name: "Release all"
on:
  workflow_dispatch:
  pull_request:
    types: [closed]
    branches: [main]

permissions:
  contents: read

run-name: "Release all"

jobs:
  enumerate:
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event.pull_request.merged == true &&
       contains(github.event.pull_request.labels.*.name, 'release'))
    runs-on: ubuntu-slim
    outputs:
      packages: ${{ steps.enumerate.outputs.packages }}
      ref: ${{ steps.release_ref.outputs.ref }}
    steps:
      - name: Set release ref
        id: release_ref
        run: echo "ref=${RELEASE_REF}" >> "$GITHUB_OUTPUT"
        env:
          RELEASE_REF: ${{ github.event.pull_request.merge_commit_sha || github.sha }}

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ steps.release_ref.outputs.ref }}
          persist-credentials: false

      - name: Verify manual dispatch runs on main
        if: github.event_name == 'workflow_dispatch'
        run: |
          if [[ "$GITHUB_REF_NAME" != "main" ]]; then
            echo "This workflow should only be run against main"
            exit 1
          fi

      - name: Enumerate packages ready for release
        id: enumerate
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          packages=()
          while IFS= read -r package; do
            [[ -z "$package" ]] && continue
            version=$(./scripts/eachdist.py version --package "$package")
            if [[ "$version" == *.dev ]]; then
              echo "Skipping ${package}: version still has .dev suffix (${version})"
              continue
            fi
            tag="${package}==${version}"
            if gh release view "$tag" >/dev/null 2>&1; then
              echo "Skipping ${package}: tag ${tag} already exists"
              continue
            fi
            echo "Ready: ${package} v${version}"
            packages+=("$package")
          done < <(./scripts/eachdist.py list-release-packages)

          if [[ ${#packages[@]} -eq 0 ]]; then
            echo "No packages ready for release"
            exit 1
          fi

          json=$(printf '%s\n' "${packages[@]}" | jq -R . | jq -s -c .)
          echo "packages=${json}" >> "$GITHUB_OUTPUT"

  build:
    needs: enumerate
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.enumerate.outputs.packages) }}
    uses: $/.github/workflows/_release-build.yml
    with:
      package: ${{ matrix.package }}
      ref: ${{ needs.enumerate.outputs.ref }}
      on_main: true

  publish:
    needs: [enumerate, build]
    runs-on: cncf-ubuntu-2-8-x86
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.enumerate.outputs.packages) }}
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist-${{ matrix.package }}
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
        with:
          packages-dir: dist/
          skip-existing: true

  github_release:
    needs: [enumerate, publish]
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.enumerate.outputs.packages) }}
    uses: $/.github/workflows/_release-finalize.yml
    with:
      package: ${{ matrix.package }}
      ref: ${{ needs.enumerate.outputs.ref }}
      on_main: true
      sync_main: false
      bump_after_release: false

  finalize:
    needs: [enumerate, publish, github_release]
    if: always() && needs.enumerate.result == 'success' && needs.publish.result == 'success' && needs.github_release.result == 'success'
    permissions:
      contents: write
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          persist-credentials: true # zizmor: ignore[artipacked] a later step pushes the post-release branch

      - name: Install uv
        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0

      - name: Bump repository version to next dev version
        run: uv run ./scripts/version_utils.py bump --dev

      - name: Regenerate instrumentations README
        run: python ./scripts/generate_instrumentation_readme.py

      - name: Use CLA approved github bot
        run: .github/scripts/use-cla-approved-github-bot.sh

      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: otelbot-token
        with:
          client-id: ${{ vars.OTELBOT_CLIENT_ID }}
          private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
          permission-pull-requests: write

      - name: Open pull request for post-release updates on main
        env:
          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
        run: |
          if git diff --quiet; then
            echo "No updates needed on main"
            exit 0
          fi

          message="Post-release version bump and updates"
          body="Regenerate instrumentation README and bump package versions in eachdist.ini and all package version.py files to the next \`.dev\` version."
          branch="otelbot/bump-after-release-all-$(date +%Y%m%d)"

          git commit -a -m "$message"
          git push origin HEAD:"$branch"
          gh pr create --title "$message" \
                       --body "$body" \
                       --head "$branch" \
                       --base main \
                       --label "Skip Changelog"