setup.yml

# Copyright © Michal Čihař <michal@weblate.org>
#
# SPDX-License-Identifier: GPL-3.0-or-later

name: Distribution

on:
  push:
    branches-ignore:
    - renovate/**
    - weblate
    - dependabot/**
    tags:
    - weblate-*
  pull_request:

permissions:
  contents: read

jobs:
  dist:
    runs-on: ubuntu-24.04
    name: Build packages
    env:
      PYTHONUNBUFFERED: 1
      PYTHONWARNINGS: default,ignore:unclosed:ResourceWarning
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      with:
        enable-cache: false
        version: 0.11.12
    - name: Setup Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: '3.14'
    - name: Set reproducible build timestamp
      run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
    - name: build
      run: |
        echo "::add-matcher::.github/matchers/setuptools.json"
        uv build
        echo "::remove-matcher owner=setuptools::"
        rm -f dist/.gitignore
    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        path: dist/*
        name: dist

  sign_dist:
    runs-on: ubuntu-24.04
    name: Sign packages
    if: github.event_name == 'push'
    needs:
    - dist
    permissions:
      contents: read
      # Needed for Sigstore
      id-token: write
      # Needed for attestations
      attestations: write
    steps:
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: dist
        path: dist
    - name: Setup Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: '3.14'
    - name: Sign the dists with Sigstore
      uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
      with:
        inputs: dist/*
    - name: Attest
      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
      with:
        subject-path: dist/*
    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        path: dist/*
        name: dist-signed

  sbom:
    runs-on: ubuntu-24.04
    name: Build SBOM
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      with:
        enable-cache: false
        version: 0.11.12
    - name: Setup Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: '3.14'
    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e   # v6.4.0
      with:
        node-version: 26
        package-manager-cache: false
    - name: Generate SBOM
      id: generate-sbom
      env:
        # renovate-cyclonedx-cli
        CYCLONEDX_CLI_VERSION: v0.32.0
        CYCLONEDX_CLI_DIGEST: sha256:454879e6a4a405c8a13bff49b8982adcb0596f3019b26b0811c66e4d7f0783e1
      run: |
        version=$(uv run --frozen --only-group sbom ./scripts/show-version.py)
        sbom="build/sbom/weblate-$version-sbom.cdx.json"
        mkdir -p build/sbom
        uv export --preview-features sbom-export --format cyclonedx1.5 --all-extras --no-dev > build/sbom/python.json
        ./scripts/reproducible-sbom.py build/sbom/python.json
        cd client
        yarn install --check-files
        npm sbom --omit dev --sbom-format cyclonedx --sbom-type application > ../build/sbom/javascript.json
        cd ..
        ./scripts/reproducible-sbom.py build/sbom/javascript.json
        cyclonedx_cli=/tmp/cyclonedx-linux-x64
        curl -fsSL "https://github.com/CycloneDX/cyclonedx-cli/releases/download/$CYCLONEDX_CLI_VERSION/cyclonedx-linux-x64" > "$cyclonedx_cli"
        echo "${CYCLONEDX_CLI_DIGEST#sha256:}  $cyclonedx_cli" | sha256sum --check --strict
        chmod +x "$cyclonedx_cli"
        "$cyclonedx_cli" merge --input-files build/sbom/*.json --output-file "$sbom"
        ./scripts/reproducible-sbom.py "$sbom"
        echo "path=$sbom" >> "$GITHUB_OUTPUT"
    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        path: ${{ steps.generate-sbom.outputs.path }}
        name: sbom

  attest_sbom:
    runs-on: ubuntu-24.04
    name: Attest SBOM
    if: github.event_name == 'push'
    needs:
    - sign_dist
    - sbom
    permissions:
      # Needed for attestations
      attestations: write
      contents: read
      id-token: write
    steps:
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: dist-signed
        path: dist
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: sbom
        path: sbom
    - name: Locate SBOM
      id: locate-sbom
      run: |
        path=$(find sbom -type f -name '*-sbom.cdx.json' -print -quit)
        test -n "$path"
        echo "path=$path" >> "$GITHUB_OUTPUT"
    - uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
      with:
        subject-path: dist/*
        sbom-path: ${{ steps.locate-sbom.outputs.path }}

  lint:
    runs-on: ubuntu-24.04
    name: Lint packages
    env:
      PYTHONUNBUFFERED: 1
    needs:
    - dist
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
    - name: Install apt dependencies
      run: sudo ./ci/apt-install
    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: '3.14'
    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      with:
        enable-cache: false
        version: 0.11.12
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: dist
        path: dist
    - name: Cleanup dist
      # Remove files not supported on PyPI (eg. Sigstore signatures)
      run: find dist -mindepth 1 -not -name '*.tar.gz' -not -name '*.whl' -delete
    - name: list wheel
      run: unzip -l dist/*.whl
    - name: list sdist
      run: tar tvf dist/*.tar.gz
    - name: twine check
      run: uvx twine check --strict dist/*
    - name: pydistcheck
      run: uvx pydistcheck --inspect dist/*
    - name: pyroma
      run: uvx --with pip pyroma dist/*.tar.gz
    - name: check-manifest
      run: uvx --with pip check-manifest -v
    - name: Prepare sdist tree for wheel comparison
      id: wheel-source
      run: |
        source_dir=$(mktemp -d)
        tar --strip-components=1 -xf dist/*.tar.gz -C "$source_dir"
        echo "path=$source_dir" >> "$GITHUB_OUTPUT"
    - name: Build source catalogs
      working-directory: ${{ steps.wheel-source.outputs.path }}
      # Wheels ship generated .mo files, while Git and sdist ship .po sources.
      # Compile catalogs before comparing the wheel against the sdist tree.
      run: uv run --with translate-toolkit --with setuptools --no-project python setup.py build_mo
    - name: check-wheel-contents
      working-directory: ${{ steps.wheel-source.outputs.path }}
      run: uvx check-wheel-contents "$GITHUB_WORKSPACE"/dist/*.whl
    - name: install
      run: |
        uv venv .venv-install
        source .venv-install/bin/activate
        uv pip install dist/*.whl

  notes:
    runs-on: ubuntu-24.04
    name: Build release notes
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      with:
        enable-cache: false
        version: 0.11.12
    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: '3.14'
    - name: Install apt dependencies
      run: |
        sudo apt update
        sudo apt install -y graphviz pandoc
    - name: Install Python dependencies
      run: uv sync --only-group docs --frozen
    - name: Sphinx build
      run: |
        . .venv/bin/activate
        ./ci/run-docs
    - name: Convert release notes
      run: |
        version=$(sed -n '/^VERSION =/ s/.*"\(.*\)"/\1/p' weblate/utils/version.py)
        namever="weblate-$version"
        sed "s/latest/$namever/" < scripts/release-notes-filter.lua > scripts/release-notes-filter.version.lua
        mkdir dist
        ./scripts/extract-release-notes.py > "dist/Weblate-$version.html"
        pandoc "dist/Weblate-$version.html" --write=gfm --wrap=none --lua-filter=scripts/release-notes-filter.version.lua -o "dist/Weblate-$version.md"
        rm scripts/release-notes-filter.version.lua
    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        path: dist/*
        name: notes

  publish_pypi:
    name: Publish to PyPI
    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/weblate')
    environment: pypi
    permissions:
      # this permission is mandatory for trusted publishing
      id-token: write
    needs:
    - notes
    - sign_dist
    - attest_sbom
    - lint
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: dist-signed
        path: dist
    - name: Cleanup dist
      # Remove files not supported on PyPI (eg. Sigstore signatures)
      run: find dist -mindepth 1 -not -name '*.tar.gz' -not -name '*.whl' -delete
    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
      with:
        enable-cache: false
        version: 0.11.12
    - run: uv publish --trusted-publishing always

  publish_github:
    name: Publish to GitHub
    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/weblate')
    permissions:
      # this permission is mandatory for creating a release
      contents: write
    needs:
    - notes
    - sign_dist
    - attest_sbom
    - lint
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: dist-signed
        path: dist
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: sbom
        path: sbom
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: notes
        path: notes
    - name: Extract notes body
      run: tail -n+3 notes/Weblate-*.md > notes.md
    - name: Extract notes title
      id: get-name
      run: echo "name=$(head -n1 notes/Weblate-*.md)"  > "$GITHUB_OUTPUT"
    - env:
        VERSION: ${{ github.ref_name }}
        GH_TOKEN: ${{ github.token }}
        TITLE: ${{ steps.get-name.outputs.name }}
      run: |
        gh release create "$VERSION" --verify-tag --title "$TITLE" --notes-file notes.md dist/* sbom/*