release.yml

# Releases are run on Azure Pipelines, not GitHub Actions, because that's where
# we have access to our code signing certificate.
#
# This build can run for every commit, as by default it does no signing.
# When run manually, signing should be enabled.

name: $(Build.SourceBranchName)-$(Date:yyyyMMdd).$(Rev:r)

parameters:
- name: Sign
  displayName: "Signed"
  type: boolean
  default: false
- name: Publish
  displayName: "Publish"
  type: boolean
  default: false
- name: PublishAppinstaller
  displayName: "Auto-update users to this release"
  type: boolean
  default: false
- name: PreTest
  displayName: "Pre test"
  type: boolean
  default: true
- name: PostTest
  displayName: "Post test"
  type: boolean
  default: true
- name: OverrideRef
  displayName: "Force version (else uses tag)"
  type: string
  default: (tag)
- name: TestSign
  displayName: "Test Signed"
  type: boolean
  default: false


variables:
  PIP_DISABLE_PIP_VERSION_CHECK: true
  PIP_NO_COLOR: true
  PIP_NO_INPUT: true
  PIP_PROGRESS_BAR: off
  PIP_REQUIRE_VIRTUALENV: false
  PIP_VERBOSE: true
  PYMSBUILD_VERBOSE: true
  PYMSBUILD_TEMP_DIR: $(Build.BinariesDirectory)
  DIST_DIR: $(Build.ArtifactStagingDirectory)
  LAYOUT_DIR: $(Build.BinariesDirectory)\layout
  TEST_MSIX_DIR: $(Build.BinariesDirectory)\test_msix
  ${{ if ne(parameters.OverrideRef, '(tag)') }}:
    OVERRIDE_REF: refs/tags/${{ parameters.OverrideRef }}


stages:
- stage: PyManagerRelease
  displayName: 'PyManager Release'

  jobs:
  - job: Build

    pool:
      vmImage: 'windows-latest'

    variables:
    - ${{ if eq(parameters.TestSign, 'true') }}:
      - group: CPythonTestSign
    - ${{ elseif eq(parameters.Sign, 'true') }}:
      - group: CPythonSign
    - ${{ if eq(parameters.Publish, 'true') }}:
      - group: PythonOrgPublish


    steps:
    - checkout: self

    - powershell: |
        # Ensure we aren't currently installed
        $msix = Get-AppxPackage PythonSoftwareFoundation.PythonManager -EA SilentlyContinue
        if ($msix) {
          Remove-AppxPackage $msix
        }
      displayName: 'Remove existing PyManager install'

    - task: NugetToolInstaller@0
      displayName: 'Install Nuget'

    - powershell: |
        nuget install python -Version 3.14.2 -x -noninteractive -o host_python
        $py = Get-Item host_python\python\tools
        Write-Host "Adding $py to PATH"
        Write-Host "##vso[task.prependpath]$py"
      displayName: Set up Python 3.14.2
      workingDirectory: $(Build.BinariesDirectory)

    - powershell: >
        python -c "import sys;
        print(sys.version);
        print(sys.executable);
        sys.exit(0 if sys.version_info[:5] == (3, 14, 2, 'final', 0) else 1)"
      displayName: Check Python version is 3.14.2

    - powershell: |
        python -m pip install "pymsbuild>=1.2.0b1"
      displayName: 'Install build dependencies'

    - ${{ if eq(parameters.PreTest, 'true') }}:
      - powershell: |
          python -m pip install pytest
        displayName: 'Install test runner'

      - powershell: |
          python -m pymsbuild -c _msbuild_test.py
        displayName: 'Build test module'

      - powershell: |
          python -m pytest -vv
        displayName: 'Run pre-test'

    - ${{ if or(eq(parameters.Sign, 'true'), eq(parameters.TestSign, 'true')) }}:
      - powershell: |
          dotnet tool install --global --prerelease sign
          cd (mkdir -Force signing)
          "*.exe", "*.pyd" | Out-File -Encoding UTF8 "signlist1.txt"
          Write-Host "##vso[task.setvariable variable=SIGNLIST1]$(gi signlist1.txt)"
          "*.msix" | Out-File -Encoding UTF8 "signlist2.txt"
          Write-Host "##vso[task.setvariable variable=SIGNLIST2]$(gi signlist2.txt)"
          "*.msi" | Out-File -Encoding UTF8 "signlist3.txt"
          Write-Host "##vso[task.setvariable variable=SIGNLIST3]$(gi signlist3.txt)"
        displayName: 'Install signing tool and generate files'
        workingDirectory: $(Build.BinariesDirectory)

      - task: AzureCLI@2
        displayName: 'Azure Login (1/2)'
        inputs:
          azureSubscription: 'Python Signing'
          scriptType: 'ps'
          scriptLocation: 'inlineScript'
          inlineScript: |
            "##vso[task.setvariable variable=AZURE_CLIENT_ID;issecret=true]${env:servicePrincipalId}" 
            "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]${env:idToken}"
            "##vso[task.setvariable variable=AZURE_TENANT_ID;issecret=true]${env:tenantId}"
          addSpnToEnvironment: true

      - powershell: >
          az login --service-principal
          -u $(AZURE_CLIENT_ID)
          --tenant $(AZURE_TENANT_ID)
          --allow-no-subscriptions
          --federated-token $(AZURE_ID_TOKEN)
        displayName: 'Azure Login (2/2)'

    - powershell: |
        python make.py
      displayName: 'Build package'
      env:
        PYMSBUILD_LAYOUT_DIR: $(LAYOUT_DIR)
        PYMSBUILD_DIST_DIR: $(DIST_DIR)
        ${{ if or(eq(parameters.Sign, 'true'), eq(parameters.TestSign, 'true')) }}:
          PYMANAGER_APPX_PUBLISHER: $(TrustedSigningCertificateSubject)

    - ${{ if or(eq(parameters.Sign, 'true'), eq(parameters.TestSign, 'true')) }}:
      - powershell: >
          dir -r *.exe, *.pyd | %{
          sign code trusted-signing "$_"
          -fd sha256 -t http://timestamp.acs.microsoft.com -td sha256
          -tse "$(TrustedSigningUri)" -tsa "$(TrustedSigningAccount)" -tscp "$(TrustedSigningCertificateName)"
          -d "PyManager $(Build.BuildNumber)"
          -fl $env:SIGNLIST1
          }
        displayName: 'Sign binaries'
        workingDirectory: $(LAYOUT_DIR)

    - powershell: |
        python make-msix.py
      displayName: 'Build MSIX package'
      env:
        PYMSBUILD_LAYOUT_DIR: $(LAYOUT_DIR)
        PYMSBUILD_DIST_DIR: $(DIST_DIR)
        ${{ if or(eq(parameters.Sign, 'true'), eq(parameters.TestSign, 'true')) }}:
          PYMANAGER_APPX_PUBLISHER: $(TrustedSigningCertificateSubject)
        PYMANAGER_APPX_STORE_PUBLISHER: 'CN=4975D53F-AA7E-49A5-8B49-EA4FDC1BB66B'

    - powershell: |
        python make-msi.py
      displayName: 'Build MSI package'
      env:
        PYMSBUILD_LAYOUT_DIR: $(LAYOUT_DIR)
        PYMSBUILD_DIST_DIR: $(DIST_DIR)
        ${{ if or(eq(parameters.Sign, 'true'), eq(parameters.TestSign, 'true')) }}:
          PYMANAGER_APPX_PUBLISHER: $(TrustedSigningCertificateSubject)

    - ${{ if or(eq(parameters.Sign, 'true'), eq(parameters.TestSign, 'true')) }}:
      - powershell: >
          dir *.msix | %{
          sign code trusted-signing "$_"
          -fd sha256 -t http://timestamp.acs.microsoft.com -td sha256
          -tse "$(TrustedSigningUri)" -tsa "$(TrustedSigningAccount)" -tscp "$(TrustedSigningCertificateName)"
          -d "PyManager $(Build.BuildNumber)"
          -fl $env:SIGNLIST2
          }
        displayName: 'Sign MSIX package'
        workingDirectory: $(DIST_DIR)

      - powershell: >
          dir *.msi | %{
          sign code trusted-signing "$_"
          -fd sha256 -t http://timestamp.acs.microsoft.com -td sha256
          -tse "$(TrustedSigningUri)" -tsa "$(TrustedSigningAccount)" -tscp "$(TrustedSigningCertificateName)"
          -d "PyManager $(Build.BuildNumber)"
          -fl $env:SIGNLIST3
          }
        displayName: 'Sign MSI package'
        workingDirectory: $(DIST_DIR)

    - ${{ if eq(parameters.TestSign, 'true') }}:
      - powershell: Write-Host "##vso[build.addbuildtag]test-signed"
        displayName: 'Add test-signed build tag'
    - ${{ elseif eq(parameters.Sign, 'true') }}:
      - powershell: Write-Host "##vso[build.addbuildtag]signed"
        displayName: 'Add signed build tag'

    - publish: $(DIST_DIR)
      artifact: dist
      displayName: Publish distribution artifacts

    - ${{ if eq(parameters.PostTest, 'true') }}:
      - ${{ if and(ne(parameters.TestSign, 'true'), eq(parameters.Sign, 'true')) }}:
        - powershell: |
            $msix = dir "$(DIST_DIR)\*.msix" | ?{ -not ($_.BaseName -match '.+-store') } | select -first 1
            Add-AppxPackage $msix
          displayName: 'Install signed MSIX'

      - ${{ else }}:
        - powershell: |
            $msix = dir "$(DIST_DIR)\*.msix" | ?{ -not ($_.BaseName -match '.+-store') } | select -first 1
            cp $msix "${msix}.zip"
            Expand-Archive "${msix}.zip" (mkdir -Force $env:TEST_MSIX)
            Add-AppxPackage -Register "${env:TEST_MSIX}\appxmanifest.xml"
          displayName: 'Register unsigned MSIX'
          env:
            TEST_MSIX: $(TEST_MSIX_DIR)

      - powershell: |
          $p = Get-AppxPackage PythonSoftwareFoundation.PythonManager
          $p
          Set-AppxPackageAutoUpdateSettings $p.PackageFamilyName -CheckOnLaunch $false
          Set-AppxPackageAutoUpdateSettings $p.PackageFamilyName -ShowPrompt $false
          Set-AppxPackageAutoUpdateSettings $p.PackageFamilyName -PauseUpdates -HoursToPause 1
          Get-AppxPackageAutoUpdateSettings $p.PackageFamilyName
        displayName: 'Update MSIX settings'

      - powershell: |
          # Some of these are likely present due to the machine configuration,
          # but we'll check for them anyway.
          gcm pymanager, pywmanager, py, python, pyw, pythonw | Format-Table -AutoSize
        displayName: 'Ensure global commands are present'

      - powershell: |
          pymanager help
        displayName: 'Show help output'
        timeoutInMinutes: 1

      - powershell: |
          pymanager install -vv default
        displayName: 'Install default runtime'
        timeoutInMinutes: 5
        env:
          PYMANAGER_DEBUG: true

      - powershell: |
          pymanager list
        displayName: 'List installed runtimes'
        timeoutInMinutes: 1
        env:
          PYMANAGER_DEBUG: true

      - powershell: |
          pymanager --list-paths
        displayName: 'List installed runtimes (legacy)'
        timeoutInMinutes: 1
        env:
          PYMANAGER_DEBUG: true

      - powershell: |
          pymanager exec -m site
        displayName: 'Launch default runtime'
        timeoutInMinutes: 1
        env:
          PYMANAGER_DEBUG: true

      - powershell: |
          pymanager uninstall -y default
        displayName: 'Uninstall runtime'
        timeoutInMinutes: 3
        env:
          PYMANAGER_DEBUG: true

      - powershell: |
          $i = (mkdir -force test_installs)
          ConvertTo-Json @{
              install_dir="$i";
              download_dir="$i\_cache";
              global_dir="$i\_bin";
          } | Out-File $env:PYTHON_MANAGER_CONFIG -Encoding utf8
          pymanager install --configure -y
          if ($?) { pymanager list }
        displayName: 'Emulate first launch'
        timeoutInMinutes: 5
        env:
          PYTHON_MANAGER_INCLUDE_UNMANAGED: false
          PYTHON_MANAGER_CONFIG: .\test-config.json
          PYMANAGER_DEBUG: true

      - powershell: |
          $env:PYTHON_MANAGER_CONFIG = (gi $env:PYTHON_MANAGER_CONFIG).FullName
          pymanager exec tests\run-eptest.py
        displayName: 'Validate entrypoint scripts'
        timeoutInMinutes: 5
        env:
          PYTHON_MANAGER_INCLUDE_UNMANAGED: false
          PYTHON_MANAGER_CONFIG: .\test-config.json
          PYMANAGER_DEBUG: true

      - powershell: |
          pymanager list --online 3 3-32 3-64 3-arm64
          pymanager install --download .\bundle 3 3-32 3-64 3-arm64
          pymanager list --source .\bundle
          pymanager install --source .\bundle 3 3-32 3-64 3-arm64
        displayName: 'Offline bundle download and install'
        timeoutInMinutes: 5
        env:
          PYMANAGER_DEBUG: true

      - powershell: |
          Get-AppxPackage PythonSoftwareFoundation.PythonManager | Remove-AppxPackage
        displayName: 'Remove MSIX'

    - powershell: |
        $files = gci -File * -EA SilentlyContinue
        $hashes = $files  | `
            Sort-Object Name | `
            Format-Table Name, @{
              Label="MD5";
              Expression={(Get-FileHash $_ -Algorithm MD5).Hash}
            }, Length -AutoSize | `
            Out-String -Width 4096
        $hashes
      workingDirectory: $(DIST_DIR)
      displayName: 'Generate hashes (MD5)'

    - ${{ if eq(parameters.Publish, 'true') }}:
      - ${{ if eq(parameters.Sign, 'true') }}:
        - task: DownloadSecureFile@1
          name: sshkey
          inputs:
            secureFile: pydotorg-ssh.ppk
          displayName: 'Download PuTTY key'

      - powershell: |
          git clone https://github.com/python/cpython-bin-deps --branch putty --single-branch --depth 1 --progress -v "putty"
          "##vso[task.prependpath]$(gi putty)"
        workingDirectory: $(Pipeline.Workspace)
        displayName: 'Download PuTTY binaries'

      - ${{ if ne(parameters.PublishAppinstaller, 'true') }}:
        - powershell: |
            "Not uploading these files:"
            dir "${env:UPLOAD_DIR}\*.appinstaller"
            del "${env:UPLOAD_DIR}\*.appinstaller" -ErrorAction SilentlyContinue
          displayName: 'Disable auto-update for this release'
          env:
            UPLOAD_DIR: $(DIST_DIR)

      - powershell: |
          # We don't want the Store MSIX on python.org, so just delete it
          # It's already been archived in the earlier publish step, and is bundled
          # into the .msixupload file.
          del "${env:UPLOAD_DIR}\*-store.msix" -ErrorAction SilentlyContinue
          python ci\upload.py
        displayName: 'Publish packages'
        env:
          UPLOAD_URL: $(PyDotOrgUrlPrefix)python/pymanager
          UPLOAD_DIR: $(DIST_DIR)
          UPLOAD_URL_PREFIX: $(PyDotOrgUrlPrefix)
          UPLOAD_PATH_PREFIX: $(PyDotOrgUploadPathPrefix)
          UPLOAD_HOST: $(PyDotOrgServer)
          UPLOAD_HOST_KEY: $(PyDotOrgHostKey)
          UPLOAD_USER: $(PyDotOrgUsername)
          UPLOAD_KEYFILE: $(sshkey.secureFilePath)
          ${{ if ne(parameters.Sign, 'true') }}:
            NO_UPLOAD: 1

      - ${{ if eq(parameters.Sign, 'true') }}:
        - powershell: Write-Host "##vso[build.addbuildtag]published"
          displayName: 'Add published tag'
      - ${{ else }}:
        - powershell: Write-Host "##vso[build.addbuildtag]test-published"
          displayName: 'Add test-published tag'