deploy.yml

# Copyright 2010 New Relic, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
name: Deploy

on:
  release:
    types:
      - published

permissions:
  contents: read

jobs:
  build-wheels:
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux glibc
          - wheel: cp39-manylinux
            os: ubuntu-24.04
          - wheel: cp310-manylinux
            os: ubuntu-24.04
          - wheel: cp311-manylinux
            os: ubuntu-24.04
          - wheel: cp312-manylinux
            os: ubuntu-24.04
          - wheel: cp313-manylinux
            os: ubuntu-24.04
          - wheel: cp313t-manylinux
            os: ubuntu-24.04
          - wheel: cp314-manylinux
            os: ubuntu-24.04
          - wheel: cp314t-manylinux
            os: ubuntu-24.04
          # Linux musllibc
          - wheel: cp39-musllinux
            os: ubuntu-24.04
          - wheel: cp310-musllinux
            os: ubuntu-24.04
          - wheel: cp311-musllinux
            os: ubuntu-24.04
          - wheel: cp312-musllinux
            os: ubuntu-24.04
          - wheel: cp313-musllinux
            os: ubuntu-24.04
          - wheel: cp313t-musllinux
            os: ubuntu-24.04
          - wheel: cp314-musllinux
            os: ubuntu-24.04
          - wheel: cp314t-musllinux
            os: ubuntu-24.04
          # Windows
          - wheel: cp313-win
            os: windows-2025
          - wheel: cp313t-win
            os: windows-2025
          - wheel: cp314-win
            os: windows-2025
          - wheel: cp314t-win
            os: windows-2025

    name: Build wheels for ${{ matrix.wheel }}
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup QEMU
        if: runner.os == 'Linux'
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # 4.1.0
        with:
          platforms: arm64

      - name: Build Wheels
        uses: pypa/cibuildwheel@9c00cb4f6b517705a3794b22395aedc36257242c # 3.2.1
        env:
          CIBW_PLATFORM: auto
          CIBW_BUILD: "${{ matrix.wheel }}*"
          CIBW_ARCHS_LINUX: x86_64 aarch64
          CIBW_ARCHS_MACOS: native
          CIBW_ARCHS_WINDOWS: AMD64 ARM64
          CIBW_ENVIRONMENT_LINUX: "LD_LIBRARY_PATH=/opt/rh/devtoolset-8/root/usr/lib64:/opt/rh/devtoolset-8/root/usr/lib:/opt/rh/devtoolset-8/root/usr/lib64/dyninst:/opt/rh/devtoolset-8/root/usr/lib/dyninst:/usr/local/lib64:/usr/local/lib"
          CIBW_ENABLE: cpython-freethreading
          CIBW_TEST_REQUIRES: pytest certifi
          CIBW_TEST_COMMAND_LINUX: "export PYTHONPATH={project}/tests; pytest {project}/tests/agent_unittests -vx"
          CIBW_TEST_COMMAND_MACOS: "export PYTHONPATH={project}/tests; pytest {project}/tests/agent_unittests -vx"
          CIBW_TEST_COMMAND_WINDOWS: "set PYTHONPATH={project}/tests; pytest {project}/tests/agent_unittests -vx"
          # Windows ARM64 tests won't run when using cross compilation. Skip unless we can move to a native windows-arm runner.
          CIBW_TEST_SKIP: "*-win_arm64"

      - name: Upload Artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # 7.0.1
        with:
          name: ${{ github.job }}-${{ matrix.wheel }}
          path: ./wheelhouse/*.whl
          if-no-files-found: error
          retention-days: 1

  build-sdist:
    name: Build sdist
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # 6.2.0
        with:
          python-version: "3.13"

      - name: Install Dependencies
        run: |
          pip install -U pip
          pip install -U build

      - name: Build Source Package
        run: |
          python -m build --sdist

      - name: Prepare MD5 Hash File
        run: |
          tarball="$(basename ./dist/*.tar.gz)"
          md5_file="${tarball}.md5"
          openssl md5 -binary "dist/${tarball}" | xxd -p | tr -d '\n' > "dist/${md5_file}"

      - name: Upload Artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # 7.0.1
        with:
          name: ${{ github.job }}-sdist
          path: |
            ./dist/*.tar.gz
            ./dist/*.tar.gz.md5
          if-no-files-found: error
          retention-days: 1

  publish:
    name: Publish
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
      attestations: write
    needs:
      - build-wheels
      - build-sdist

    strategy:
      matrix:
        pypi-instance:
          - pypi
          # Valid values for deployment are:
          # - "pypi" for production
          # - "testpypi" for testing
          # - "build-only" to skip publishing and only test builds.

    environment: ${{ matrix.pypi-instance }}

    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
        with:
          path: ./dist/
          merge-multiple: true

      - name: Upload Package to S3
        if: matrix.pypi-instance == 'pypi'
        run: |
          tarball="$(basename ./dist/*.tar.gz)"
          md5_file="${tarball}.md5"
          aws s3 cp "dist/${md5_file}" "${S3_DST}/${md5_file}"
          aws s3 cp "dist/${tarball}" "${S3_DST}/${tarball}"
          rm "dist/${md5_file}"
        env:
          S3_DST: s3://nr-downloads-main/python_agent/release
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-west-2

      - name: Upload Package to PyPI
        if: matrix.pypi-instance == 'pypi'
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # 1.14.0

      - name: Upload Package to TestPyPI
        if: matrix.pypi-instance == 'testpypi'
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # 1.14.0
        with:
          repository-url: https://test.pypi.org/legacy/

      - name: Attest
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # 4.1.0
        id: attest
        with:
          subject-path: |
            ./dist/*.whl
            ./dist/*.tar.gz

      - name: Wait for release to be available
        if: matrix.pypi-instance == 'pypi'
        id: wait
        run: |
          sleep 60

      - name: Create release tags for Lambda and K8s Init Containers
        if: matrix.pypi-instance == 'pypi'
        run: |
          RELEASE_TITLE="New Relic Python Agent ${GITHUB_REF_NAME}.0"
          RELEASE_TAG="${GITHUB_REF_NAME}.0_python"
          RELEASE_NOTES="Automated release for [Python Agent ${GITHUB_REF_NAME}](https://github.com/newrelic/newrelic-python-agent/releases/tag/${GITHUB_REF_NAME})"
          gh auth login --with-token <<< "$GH_RELEASE_TOKEN"
          echo "newrelic/newrelic-lambda-layers - Releasing \"${RELEASE_TITLE}\" with tag ${RELEASE_TAG}"
          gh release create "${RELEASE_TAG}" --title="${RELEASE_TITLE}" --repo=newrelic/newrelic-lambda-layers --notes="${RELEASE_NOTES}"
          echo "newrelic/newrelic-agent-init-container - Releasing \"${RELEASE_TITLE}\" with tag ${RELEASE_TAG}"
          gh release create "${RELEASE_TAG}" --title="${RELEASE_TITLE}" --repo=newrelic/newrelic-agent-init-container --notes="${RELEASE_NOTES}"
        env:
          GH_RELEASE_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}

  update-agent-metadata:
    needs: [publish]
    permissions:
      contents: read
    uses: ./.github/workflows/agent-metadata.yml
    with:
      version: ${{ github.ref_name }}
      agent-type: "NRPythonAgent"
    secrets:
      FC_SYS_ID_CLIENT_ID: ${{ secrets.FC_SYS_ID_CLIENT_ID }}
      FC_SYS_ID_PR_KEY: ${{ secrets.FC_SYS_ID_PR_KEY }}
      APM_CONTROL_NR_LICENSE_KEY_STAGING: ${{ secrets.APM_CONTROL_NR_LICENSE_KEY_STAGING }}