chore(deps): lock file maintenance #4624
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deployment | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| pull_request: | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' | |
| - 'mkdocs.yml' | |
| schedule: | |
| - cron: '0 10 * * *' | |
| permissions: {} | |
| jobs: | |
| deploy-pypi: | |
| name: PyPI deployment | |
| runs-on: "ubuntu-latest" | |
| if: github.event_name != 'push' || github.repository == 'DIRACGrid/diracx' | |
| outputs: | |
| new-version: ${{ steps.check-tag.outputs.new-version }} | |
| create-release: ${{ steps.check-tag.outputs.create-release }} | |
| permissions: | |
| id-token: write # IMPORTANT: this permission is mandatory for trusted publishing on pypi | |
| actions: write | |
| checks: write | |
| contents: write | |
| deployments: write | |
| discussions: write | |
| issues: write | |
| packages: write | |
| pages: write | |
| pull-requests: write | |
| repository-projects: write | |
| security-events: write | |
| statuses: write | |
| defaults: | |
| run: | |
| # We need extglob for REFERENCE_BRANCH substitution | |
| shell: bash -l -O extglob {0} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| token: ${{ github.token }} | |
| persist-credentials: false | |
| - run: | | |
| git fetch --prune --unshallow | |
| git config --global user.email "ci@diracgrid.org" | |
| git config --global user.name "DIRACGrid CI" | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.14' | |
| - name: Installing dependencies | |
| run: | | |
| python -m pip install \ | |
| build \ | |
| python-dateutil \ | |
| pytz \ | |
| readme_renderer[md] \ | |
| requests \ | |
| setuptools_scm | |
| - name: Validate README for PyPI | |
| run: | | |
| python -m readme_renderer README.md -o /tmp/README.html | |
| - name: Extract version from tag | |
| id: check-tag | |
| env: | |
| GITHUB_REF: ${{ github.ref }} | |
| run: | | |
| set -xeuo pipefail | |
| IFS=$'\n\t' | |
| # Check if this is a tag push | |
| if [[ "${GITHUB_REF}" == refs/tags/* ]]; then | |
| # Extract version from the tag | |
| export NEW_VERSION="${GITHUB_REF#refs/tags/}" | |
| echo "Deploying release $NEW_VERSION" | |
| echo "create-release=true" >> $GITHUB_OUTPUT | |
| echo "new-version=$NEW_VERSION" >> $GITHUB_OUTPUT | |
| else | |
| echo "Not a tag push, skipping release" | |
| echo "create-release=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Build distributions | |
| run: | | |
| for pkg_dir in $PWD/diracx-*; do | |
| echo "Building $pkg_dir" | |
| python -m build --outdir $PWD/dist $pkg_dir | |
| done | |
| # Also build the diracx metapackage | |
| python -m build --outdir $PWD/dist . | |
| - name: 'Upload Artifact' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: diracx-whl | |
| path: dist/diracx*.whl | |
| retention-days: 5 | |
| # Use trusted publisher for pypi | |
| # https://docs.pypi.org/trusted-publishers/ | |
| - name: Publish package on PyPI | |
| if: steps.check-tag.outputs.create-release == 'true' | |
| uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 | |
| with: | |
| # Generate and upload PEP 740 attestations (build provenance) for the wheels. | |
| attestations: true | |
| docker: | |
| needs: deploy-pypi | |
| timeout-minutes: 30 | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write # push images to ghcr.io | |
| id-token: write # OIDC for sigstore signing of attestations | |
| attestations: write # write build-provenance attestations | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Login to GitHub container registry | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push services (release) | |
| id: build-services-release | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| if: ${{ needs.deploy-pypi.outputs.create-release == 'true' }} | |
| with: | |
| context: . | |
| file: containers/Dockerfile | |
| build-args: PIXI_ENV=container-services | |
| push: true | |
| tags: "ghcr.io/diracgrid/diracx/services:${{ needs.deploy-pypi.outputs.new-version }}" | |
| platforms: linux/amd64,linux/arm64 | |
| - name: Attest services (release) | |
| if: ${{ needs.deploy-pypi.outputs.create-release == 'true' }} | |
| uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 | |
| with: | |
| subject-name: ghcr.io/diracgrid/diracx/services | |
| subject-digest: ${{ steps.build-services-release.outputs.digest }} | |
| push-to-registry: true | |
| - name: Build and push tasks (release) | |
| id: build-tasks-release | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| if: ${{ needs.deploy-pypi.outputs.create-release == 'true' }} | |
| with: | |
| context: . | |
| file: containers/Dockerfile | |
| build-args: PIXI_ENV=container-tasks | |
| push: true | |
| tags: "ghcr.io/diracgrid/diracx/tasks:${{ needs.deploy-pypi.outputs.new-version }}" | |
| platforms: linux/amd64,linux/arm64 | |
| - name: Attest tasks (release) | |
| if: ${{ needs.deploy-pypi.outputs.create-release == 'true' }} | |
| uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 | |
| with: | |
| subject-name: ghcr.io/diracgrid/diracx/tasks | |
| subject-digest: ${{ steps.build-tasks-release.outputs.digest }} | |
| push-to-registry: true | |
| - name: Build and push client (release) | |
| id: build-client-release | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| if: ${{ needs.deploy-pypi.outputs.create-release == 'true' }} | |
| with: | |
| context: . | |
| file: containers/Dockerfile | |
| build-args: PIXI_ENV=container-client | |
| push: true | |
| tags: "ghcr.io/diracgrid/diracx/client:${{ needs.deploy-pypi.outputs.new-version }}" | |
| platforms: linux/amd64,linux/arm64 | |
| - name: Attest client (release) | |
| if: ${{ needs.deploy-pypi.outputs.create-release == 'true' }} | |
| uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 | |
| with: | |
| subject-name: ghcr.io/diracgrid/diracx/client | |
| subject-digest: ${{ steps.build-client-release.outputs.digest }} | |
| push-to-registry: true | |
| - name: Build and push services (dev) | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| file: containers/Dockerfile | |
| build-args: PIXI_ENV=container-services | |
| push: ${{ github.event_name != 'pull_request' && github.repository == 'DIRACGrid/diracx' && github.ref_name == 'main' }} | |
| tags: ghcr.io/diracgrid/diracx/services:dev | |
| platforms: linux/amd64,linux/arm64 | |
| - name: Build and push tasks (dev) | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| file: containers/Dockerfile | |
| build-args: PIXI_ENV=container-tasks | |
| push: ${{ github.event_name != 'pull_request' && github.repository == 'DIRACGrid/diracx' && github.ref_name == 'main' }} | |
| tags: ghcr.io/diracgrid/diracx/tasks:dev | |
| platforms: linux/amd64,linux/arm64 | |
| - name: Build and push client (dev) | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| file: containers/Dockerfile | |
| build-args: PIXI_ENV=container-client | |
| push: ${{ github.event_name != 'pull_request' && github.repository == 'DIRACGrid/diracx' && github.ref_name == 'main' }} | |
| tags: ghcr.io/diracgrid/diracx/client:dev | |
| platforms: linux/amd64,linux/arm64 | |
| update-charts: | |
| name: Update Helm charts | |
| needs: | |
| - deploy-pypi | |
| - docker | |
| runs-on: ubuntu-latest | |
| if: ${{ needs.deploy-pypi.outputs.create-release == 'true' }} | |
| steps: | |
| - name: Checkout diracx | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| path: diracx | |
| persist-credentials: false | |
| - name: Checkout diracx-charts | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| repository: DIRACGrid/diracx-charts | |
| token: ${{ secrets.CHARTS_UPDATE_TOKEN }} | |
| path: diracx-charts | |
| persist-credentials: true | |
| - name: Configure Git | |
| run: | | |
| cd diracx-charts | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| - name: Update chart versions | |
| id: update-versions | |
| env: | |
| NEW_CHART_VERSION: ${{ needs.deploy-pypi.outputs.new-version }} | |
| run: | | |
| cd diracx-charts | |
| VERSION="${NEW_CHART_VERSION}" | |
| # Get current chart version before updating | |
| CURRENT_CHART_VERSION=$(grep '^version:' diracx/Chart.yaml | sed 's/version: //' | tr -d '"') | |
| # Use Python script to update versions | |
| python ../diracx/.github/workflows/update_chart_version.py \ | |
| --charts-dir . \ | |
| --app-version "$VERSION" | |
| # Get new chart version after update | |
| NEW_CHART_VERSION=$(grep '^version:' diracx/Chart.yaml | sed 's/version: //' | tr -d '"') | |
| echo "current_chart_version=$CURRENT_CHART_VERSION" >> $GITHUB_OUTPUT | |
| echo "new_chart_version=$NEW_CHART_VERSION" >> $GITHUB_OUTPUT | |
| echo "diracx_version=$VERSION" >> $GITHUB_OUTPUT | |
| - uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0 | |
| with: | |
| working-directory: ./diracx-charts | |
| - name: Run pre-commit to update README | |
| run: | | |
| cd diracx-charts | |
| pixi run pre-commit run --all-files || true | |
| - name: Commit and push changes | |
| if: success() | |
| env: | |
| CURRENT_CHART_VERSION: ${{ steps.update-versions.outputs.current_chart_version }} | |
| NEW_CHART_VERSION: ${{ steps.update-versions.outputs.new_chart_version }} | |
| DIRACX_VERSION: ${{ steps.update-versions.outputs.diracx_version }} | |
| run: | | |
| cd diracx-charts | |
| # Update the diagram to reflect the updated version number | |
| pixi run generate-diagram | |
| # Stage all changes | |
| git add -A | |
| # Check if there are changes to commit | |
| if ! git diff --cached --quiet; then | |
| # Commit the changes | |
| git commit -m "chore: bump chart to ${NEW_CHART_VERSION} for DiracX ${DIRACX_VERSION} | |
| - Update appVersion to ${DIRACX_VERSION} | |
| - Update image tag to ${DIRACX_VERSION} | |
| - Bump chart version from ${CURRENT_CHART_VERSION} to ${NEW_CHART_VERSION}" | |
| git push origin master | |
| echo "✅ Successfully pushed chart version ${NEW_CHART_VERSION} and tag ${TAG_NAME}" | |
| else | |
| echo "No changes to commit" | |
| fi |