release.yml

# SPDX-FileCopyrightText: Copyright (c) 2024-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

name: "CI: Release"

# Manually-triggered release workflow. Creates a release draft if one doesn't exist for the given tag, or uses existing draft.

on:
  workflow_dispatch:
    inputs:
      component:
        description: "Component to release"
        required: true
        type: choice
        options:
          - cuda-core
          - cuda-bindings
          - cuda-pathfinder
          - cuda-python
          - all
      git-tag:
        description: "The release git tag"
        required: true
        type: string
      run-id:
        description: "The GHA run ID that generated validated artifacts (optional - will be auto-detected from git tag if not provided)"
        required: false
        type: string
        default: ""
      build-ctk-ver:
        type: string
        required: true
      wheel-dst:
        description: "Which wheel index to publish to?"
        required: true
        type: choice
        options:
          - testpypi
          - pypi

defaults:
  run:
    shell: bash --noprofile --norc -xeuo pipefail {0}

jobs:
  determine-run-id:
    runs-on: ubuntu-latest
    outputs:
      run-id: ${{ steps.lookup-run-id.outputs.run-id }}
    steps:
      - name: Checkout Source
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
        with:
          # fetch-depth: 0 is required so the lookup-run-id script can access all git tags
          fetch-depth: 0

      - name: Determine Run ID
        id: lookup-run-id
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if [[ -n "${{ inputs.run-id }}" ]]; then
            echo "Using provided run ID: ${{ inputs.run-id }}"
            echo "run-id=${{ inputs.run-id }}" >> $GITHUB_OUTPUT
          else
            echo "Auto-detecting run ID for tag: ${{ inputs.git-tag }}"
            RUN_ID=$(./ci/tools/lookup-run-id "${{ inputs.git-tag }}" "${{ github.repository }}")
            echo "Auto-detected run ID: $RUN_ID"
            echo "run-id=$RUN_ID" >> $GITHUB_OUTPUT
          fi

  check-tag:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Source
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
        with:
          fetch-depth: 0

      - name: Check or create draft release for the tag
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tags=
          for i in $(gh release list -R ${{ github.repository }} --json tagName --jq '.[]| .tagName'); do
            tags+=( $i )
          done
          is_draft=
          for i in $(gh release list -R ${{ github.repository }} --json isDraft --jq '.[]| .isDraft'); do
            is_draft+=( $i )
          done

          found=0
          for idx in ${!tags[@]}; do
            if [[ "${tags[$idx]}" == "${{ inputs.git-tag }}" ]]; then
              echo "found existing release for ${{ inputs.git-tag }}"
              found=1
              if [[ "${is_draft[$idx]}" != "true" ]]; then
                echo "the release note is not in draft state"
                exit 1
              fi
              break
            fi
          done
          if [[ "$found" == 0 ]]; then
            echo "no release found for ${{ inputs.git-tag }}, creating draft release"
            gh release create "${{ inputs.git-tag }}" --draft --repo "${{ github.repository }}" --title "Release ${{ inputs.git-tag }}" --notes "Release ${{ inputs.git-tag }}"
          fi

  doc:
    name: Build release docs
    if: ${{ github.repository_owner == 'nvidia' }}
    # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
    permissions:
      id-token: write
      contents: write
      pull-requests: write
    needs:
      - check-tag
      - determine-run-id
    secrets: inherit
    uses: ./.github/workflows/build-docs.yml
    with:
      build-ctk-ver: ${{ inputs.build-ctk-ver }}
      component: ${{ inputs.component }}
      git-tag: ${{ inputs.git-tag }}
      run-id: ${{ needs.determine-run-id.outputs.run-id }}
      is-release: true

  upload-archive:
    name: Upload source archive
    permissions:
      contents: write
    needs:
      - check-tag
      - determine-run-id
    secrets: inherit
    uses: ./.github/workflows/release-upload.yml
    with:
      git-tag: ${{ inputs.git-tag }}
      run-id: ${{ needs.determine-run-id.outputs.run-id }}
      component: ${{ inputs.component }}

  publish-wheels:
    name: Publish wheels
    runs-on: ubuntu-latest
    needs:
      - check-tag
      - determine-run-id
    environment:
      name: ${{ inputs.wheel-dst }}
      url: https://${{ (inputs.wheel-dst == 'testpypi' && 'test.') || '' }}pypi.org/p/${{ inputs.component }}/
    permissions:
      id-token: write
    steps:
      - name: Checkout Source
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0

      - name: Download component wheels
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          ./ci/tools/download-wheels "${{ needs.determine-run-id.outputs.run-id }}" "${{ inputs.component }}" "${{ github.repository }}" "dist"

      - name: Publish package distributions to PyPI
        if: ${{ inputs.wheel-dst == 'pypi' }}
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0

      - name: Publish package distributions to TestPyPI
        if: ${{ inputs.wheel-dst == 'testpypi' }}
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0
        with:
          repository-url: https://test.pypi.org/legacy/

  # TODO: add another job to make the release leave the draft state?