action.yml

name: ozi-release
description: "OZI release draft action."
inputs:
  python-dist:
    description: "python dist version string e.g. security1, security2, bugfix, prerelease"
    required: true
  github-token:
    description: "GitHub workflow-generated token"
    required: true
  tag:
    description: "release tag name"
    required: true
outputs:
  hashes:
    description: "release file hashes for provenance"
    value: ${{ steps.hash.outputs.hashes }}
runs:
  using: "composite"
  steps:

  - name: Get OZI specification API
    id: api
    run: |
      echo "python-version=$( curl -L https://oziproject.dev/api.json | jq -c '.spec.python.support.${{ inputs.python-dist }}' )" >> $GITHUB_OUTPUT
      echo "ozi-build=$( curl -L https://oziproject.dev/api.json | jq -c '.spec.python.build.requires."OZI.build"' )" >> $GITHUB_OUTPUT
      echo "tox=$( curl -L https://oziproject.dev/api.json | jq -c '.spec.python.ci.backend.tox' )" >> $GITHUB_OUTPUT
      echo "tox-gh=$( curl -L https://oziproject.dev/api.json | jq -c '.spec.python.ci.backend."tox-gh"' )" >> $GITHUB_OUTPUT
    shell: bash

  - name: Get Python tag
    id: cibuildwheel-support
    run: |
      echo "tag=$( echo ${{ steps.api.outputs.python-version }} | sed 's/\.//' )" >> $GITHUB_OUTPUT
    shell: bash

  - uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806
    with:
      name: ${{ inputs.python-dist }}

  - name: Set up Python ${{ steps.api.outputs.python-version }}
    uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38
    with:
      cache: 'pip'
      python-version: ${{ fromJSON(steps.api.outputs.python-version) }}
      allow-prereleases: true
      check-latest: true

  - name: Install build dependencies
    run: |
        python -m pip install --upgrade pip
        python -m pip install --user -r ${GITHUB_ACTION_PATH}/requirements.txt
        pipx ensurepath --force
        pipx install meson --force
    shell: bash

  - name: Configure git repository
    if: inputs.python-dist == 'security2'
    run: |
        git config --global user.email "noreply@oziproject.dev"
        git config --global user.name "OZI Packaging"
        rm -rf .git/COMMIT_EDITMSG
    shell: bash

  - name: Hiding README.rst symlink from SCM
    continue-on-error: true
    run: |
        git update-index --skip-worktree README.rst
    shell: bash

  - name: Hiding README.md symlink from SCM
    continue-on-error: true
    run: |
        git update-index --skip-worktree README.md
    shell: bash

  - name: Hiding README.txt symlink from SCM
    continue-on-error: true
    run: |
        git update-index --skip-worktree README.txt
    shell: bash

  - name: Hiding subprojects/ozi
    continue-on-error: true
    run: |
        git update-index --skip-worktree subprojects/ozi
    shell: bash

  - name: git diff
    run: git diff
    shell: bash

  - name: Build and sign wheel
    if: contains(fromJSON('["prerelease", "security1", "security2"]'), inputs.python-dist)
    run: |
        tox -e invoke -- release
    shell: bash

  - name: git diff
    run: git diff
    shell: bash

  - name: Build and sign sdist then wheel
    if: inputs.python-dist == 'bugfix'
    id: sdist
    run: |
        tox -e invoke -- release --sdist
    shell: bash

  - uses: sigstore/gh-action-sigstore-python@f514d46b907ebcd5bedc05145c03b69c1edd8b46
    if: inputs.python-dist == 'bugfix'
    with:
      inputs: |
        dist/${{ github.event.repository.name }}-${{ inputs.tag }}.tar.gz
        dist/*.whl
      release-signing-artifacts: true
      upload-signing-artifacts: true

  - name: Move wheel signing files
    if: inputs.python-dist == 'prerelease'
    run: |
      mkdir sig
      mv dist/*.whl.sigstore.json sig
      mv dist/*.tar.gz.sigstore.json sig
      rm -rf dist/*.dist-info
    shell: bash

  - name: Generate hashes for provenance
    shell: bash
    id: hash
    if: inputs.python-dist == 'prerelease'
    run: |
      # sha256sum generates sha256 hash for all artifacts.
      # base64 -w0 encodes to base64 and outputs on a single line.
      # sha256sum artifact1 artifact2 ... | base64 -w0
      echo "hashes=$(sha256sum ./dist/* | base64 -w0)" >> $GITHUB_OUTPUT

  - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1
    if: inputs.python-dist == 'security2'
    with:
      include-hidden-files: true
      name: 'security1'
      path: |
        !*-checkpoint/
        !.git/config
        !signing-artifacts-*/
        !security2/
        !build/
        ./

  - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1
    if: inputs.python-dist == 'security1'
    with:
      include-hidden-files: true
      name: 'bugfix'
      path: |
        !security1/
        !build/
        ./

  - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1
    if: inputs.python-dist == 'bugfix'
    with:
      include-hidden-files: true
      name: 'prerelease'
      path: |
        !bugfix/
        !build/
        ./

  - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1
    if: inputs.python-dist == 'prerelease'
    with:
      include-hidden-files: true
      path: |
        !prerelease/
        !build/
        ./