publish.yml

name: Publish package

on:
  workflow_dispatch:
    inputs:
      release_tag:
        type: string
        required: true
        description: The release tag to fetch the package to publish
      nightly:
        type: boolean
        required: false
        description: Whether to publish the package as a nightly release
        default: true
  workflow_call:
    inputs:
      release_tag:
        type: string
        required: true
        description: The release tag to fetch the package to publish
      nightly:
        type: boolean
        required: false
        description: Whether to publish the package as a nightly release
        default: true
    secrets:
      SNAPCRAFT_CREDENTIALS:
        required: true
      PYPI_CREDENTIALS:
        required: true
  release:
    types:
      - published
      - edited
  pull_request:
    paths:
      - .github/workflows/publish.yml

# We set `concurrency` to prevent having this workflow being run on code that is not up-to-date on a PR (a user make multiple push in a quick manner).
# But on the main branch, we don't want that behavior.
# Having the workflow run on each merge commit is something we would like, that could help us where a regression was made and missed by previous checks.
concurrency:
  group: publish-package-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true


env:
  RELEASE_TAG: ${{ (github.event_name == 'release' && github.ref_name) || (github.event_name == 'pull_request' && 'nightly') || inputs.release_tag }}

jobs:
  publish:
    runs-on: ubuntu-24.04
    # We don't want to run this workflow on dependabot PRs because it will not be able to read the secrets
    if: (!(github.event_name == 'pull_request' && github.actor == 'dependabot[bot]'))
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin v4.2.2
        with:
          sparse-checkout: |
            misc
        timeout-minutes: 5

      - name: Get tag version
        id: version
        shell: bash -eux -o pipefail {0}
        run: >-
          gh release
          --repo=${{ github.server_url }}/${{ github.repository }}
          download
          ${{ env.RELEASE_TAG }}
          --pattern=version
          --output=- | tee -a $GITHUB_OUTPUT
        env:
          GH_TOKEN: ${{ github.token }}
        timeout-minutes: 2

      - name: Download Wheels from release
        run: |
          mkdir dist
          gh release \
            --repo=${{ github.server_url }}/${{ github.repository }} \
            download \
            ${{ env.RELEASE_TAG }} \
            --pattern=parsec_cloud-${{ steps.version.outputs.pep440 }}-*.whl \
            --dir=dist
        env:
          GH_TOKEN: ${{ github.token }}
        timeout-minutes: 2

      - name: Download snap from release
        run: |
          mkdir snap
          gh release \
            --repo=${{ github.server_url }}/${{ github.repository }} \
            download \
            ${{ env.RELEASE_TAG }} \
            --pattern=Parsec_${{ steps.version.outputs.full }}_linux_*.snap \
            --dir=snap
        env:
          GH_TOKEN: ${{ github.token }}
        timeout-minutes: 2

      - name: List downloaded files
        run: tree dist snap

      - name: Install Snapcraft
        uses: samuelmeuli/action-snapcraft@fceeb3c308e76f3487e72ef608618de625fb7fe8 # pin v3.0.1
        timeout-minutes: 2

      - name: Get releases for snapcraft
        id: snapcraft-channels
        shell: bash
        run: >-
          (
            echo -n "channels=";
            python misc/snapcraft_releases.py ${{ inputs.nightly && '--nightly' || '' }} ${{ steps.version.outputs.full }}
          ) | tee $GITHUB_OUTPUT
        timeout-minutes: 1

      - name: Check that snapcraft credential is not empty
        shell: bash
        run: test $(printenv SNAPCRAFT_STORE_CREDENTIALS | wc -c | tee /dev/stderr) -gt 10
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_CREDENTIALS }}
        timeout-minutes: 1

      - name: Whoami snap
        run: snapcraft whoami
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_CREDENTIALS }}
        timeout-minutes: 2

      - name: Upload Snap
        run: snapcraft upload --release="${{ steps.snapcraft-channels.outputs.channels }}" snap/Parsec_${{ steps.version.outputs.full }}_linux_*.snap
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_CREDENTIALS }}
        timeout-minutes: 3

      - name: Publish wheel on PyPI
        if: steps.version.outputs.local == ''
        uses: pypa/gh-action-pypi-publish@15c56dba361d8335944d31a2ecd17d700fc7bcbc # pin v1.12.2
        with:
          user: __token__
          password: ${{ secrets.PYPI_CREDENTIALS }}
        timeout-minutes: 2