release-codecov-cli.yml

# This workflow builds and publishes codecov-cli on release creation.
# sentry-prevent-cli is built and published separately (managed by craft)
name: Build and publish codecov-cli

on:
  push: #temp
  # release:
  #   types:
  #     - created

permissions:
  contents: read

jobs:
  build_for_pypi:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install dependencies
        run: pip install uv

      - name: Build codecov-cli sdist and bdist
        run: |
          cd codecov-cli
          uv build

      - name: Build prevent-cli sdist and bdist
        run: |
          cd prevent-cli
          uv build

      - name: Upload codecov-cli artifacts
        uses: actions/upload-artifact@v4
        with:
          name: codecov-cli-pypi
          path: ./codecov-cli/dist/*

      - name: Upload prevent-cli artifacts
        uses: actions/upload-artifact@v4
        with:
          name: prevent-cli-pypi
          path: ./prevent-cli/dist/*

  # publish_to_pypi:
  #   needs: build_for_pypi
  #   permissions:
  #     id-token: write # This is required for OIDC
  #   runs-on: ubuntu-latest
  #   environment:
  #     name: pypi
  #     url: https://pypi.org/p/codecov-cli
  #   steps:
  #     - name: Download build artifacts
  #       uses: actions/download-artifact@v4
  #       with:
  #         name: pypi
  #         path: codecov-cli/dist
  #
  #     - name: Publish package to PyPi
  #       uses: pypa/gh-action-pypi-publish@release/v1
  #       with:
  #         verbose: true
  #         packages-dir: codecov-cli/dist

  build_assets:
    name: Build ${{ matrix.os }} binaries
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: true
      matrix:
        include:
          - os: macos-latest
            TARGET: macos
            CMD_BUILD: >
              uv run pyinstaller --target-arch universal2 -F codecov_cli/main.py &&
              mv dist/main dist/codecovcli_macos && 
              uv run pyinstaller --target-arch universal2 -F prevent_cli/main.py &&
              mv dist/main dist/sentry-prevent-cli_macos
            OUT_FILE_SUFFIX: _macos
            ASSET_MIME: application/octet-stream

          - os: windows-latest
            TARGET: windows
            CMD_BUILD: >
              uv run pyinstaller -F codecov_cli\main.py &&
              Move-Item -Path ".\dist\main.exe" -Destination ".\dist\codecovcli_windows.exe" &&
              uv run pyinstaller -F prevent-cli\main.py &&
              Move-Item -Path ".\dist\main.exe" -Destination ".\dist\sentry-prevent-cli_windows.exe"
            OUT_FILE_SUFFIX: _windows.exe
            ASSET_MIME: application/vnd.microsoft.portable-executable

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.9
        uses: actions/setup-python@v3
        with:
          python-version: "3.9"

      - name: Install dependencies
        run: |
          pip install uv
          cd prevent-cli # codecov-cli is a dependency of prevent-cli
          # Need to build pyyaml and ijson from sdists to get universal2 macos build to work
          uv sync --no-binary-package pyyaml --no-binary-package ijson 
          uv add --dev pyinstaller

      - name: Build with pyinstaller for ${{matrix.TARGET}}
        run: cd codecov-cli && ${{matrix.CMD_BUILD}}

      - name: Upload codecovcli binary for ${{matrix.TARGET}}
        uses: actions/upload-artifact@v4
        with:
          name: codecovcli${{matrix.OUT_FILE_SUFFIX}}
          path: ./codecov-cli/dist/codecovcli${{matrix.OUT_FILE_SUFFIX}}

      - name: Upload sentry-prevent-cli binary for ${{matrix.TARGET}}
        uses: actions/upload-artifact@v4
        with:
          name: sentry-prevent-cli${{matrix.OUT_FILE_SUFFIX}}
          path: ./prevent-cli/dist/sentry-prevent-cli${{matrix.OUT_FILE_SUFFIX}}

  build_linux_assets:
    name: Build ${{ matrix.distro_name }}_${{ matrix.arch }} binary
    runs-on: ${{ matrix.runs-on }}
    strategy:
      matrix:
        include:
          - distro: "alpine:3.14" # alpine 3.14 needed for musl 1.2.2/python 3.9 compatibility
            arch: arm64
            distro_name: alpine
            runs-on: ubuntu-24.04-arm
          - distro: "alpine:3.14"
            arch: x86_64
            distro_name: alpine
            runs-on: ubuntu-24.04
          - distro: "ubuntu:20.04" # ubuntu 20.04 needed for glibc 2.31/python 3.9 compatibility
            arch: arm64
            distro_name: linux
            runs-on: ubuntu-24.04-arm
          - distro: "ubuntu:20.04"
            distro_name: linux
            arch: x86_64
            runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@v4

      - name: Run in Docker
        run: |
          docker run \
            --rm \
            -v $(pwd):/${{ github.workspace }} \
            -w ${{ github.workspace }} \
            --platform linux/${{ matrix.arch }} \
            ${{ matrix.distro }} \
            ./codecov-cli/scripts/build_${{ matrix.distro_name }}.sh ${{ matrix.distro_name }}_${{ matrix.arch }}

      - name: Upload codecovcli binary for ${{matrix.distro_name}}_${{ matrix.arch}}
        uses: actions/upload-artifact@v4
        with:
          name: codecovcli_${{ matrix.distro_name }}_${{ matrix.arch }}
          path: ./codecov-cli/dist/codecovcli_*

      - name: Upload sentry-prevent-cli binary for ${{matrix.distro_name}}_${{ matrix.arch}}
        uses: actions/upload-artifact@v4
        with:
          name: sentry-prevent-cli_${{ matrix.distro_name }}_${{ matrix.arch }}
          path: ./prevent-cli/dist/sentry-prevent-cli_*

      # - name: Get auth token
      #   id: token
      #   uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
      #   with:
      #     app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
      #     private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
      #
      # - name: Upload Release Asset
      #   id: upload-release-asset
      #   uses: svenstaro/upload-release-action@v2
      #   with:
      #     repo_token: ${{ steps.token.outputs.token }}
      #     file_glob: true
      #     file: ./codecov-cli/dist/codecovcli_*
      #     tag: ${{ github.ref }}
      #     overwrite: true

  # publish_release:
  #   name: Publish release
  #   needs: [build_assets, build_linux_assets, build_for_pypi, publish_to_pypi]
  #   runs-on: ubuntu-latest
  #   permissions:
  #     contents: "read"
  #     id-token: "write"
  #   steps:
  #     - id: "auth"
  #       name: "Authenticate to Google Cloud"
  #       uses: "google-github-actions/auth@v1.0.0"
  #       with:
  #         create_credentials_file: "true"
  #         workload_identity_provider: ${{ secrets.CODECOV_GCP_WIDP }}
  #         service_account: ${{ secrets.CODECOV_GCP_WIDSA }}
  #
  #     # Publish the release tag to a Pub/Sub topic
  #     - name: Publish a message to a Pub/Sub topic
  #       env:
  #         CLOUDSDK_CORE_PROJECT: ${{ secrets.GCLOUD_UPLOADER_PROJECT_ID }}
  #       run: |
  #         gcloud pubsub topics publish ${{ secrets.GCLOUD_UPLOADER_PUBSUB_TOPIC }} --message '{"release":"'"${{ github.ref_name }}"'", "latest":true}'