action.yml

name: 'Publish to GitLab PyPI Package Registry'
description: >
  Uploads Python distributions (wheels and/or sdists) from a GitHub Actions
  runner to a GitLab PyPI Package Registry endpoint via twine. Packages
  uploaded here are pip-discoverable through the /packages/pypi/simple
  index — unlike the Generic Package Registry, which cannot be consumed
  by pip.

inputs:

  # ── Required ────────────────────────────────────────────────────────────────

  gitlab-username:
    description: >
      Username for basic auth against the GitLab PyPI endpoint. For a
      deploy token this is the token name (e.g.
      "gitlab+deploy-token-12345"). For a personal access token use
      "__token__" (or any placeholder).
    required: true

  gitlab-token:
    description: >
      GitLab authentication token used as the password for basic auth.
      Use a Personal Access Token (scope: api) or a Deploy Token (scope:
      write_package_registry). Store as a GitHub Actions secret; never
      hard-code.
    required: true

  gitlab-project-id:
    description: >
      Numeric ID of the target GitLab project (Settings → General →
      Project ID).
    required: true

  # files is a newline-separated list of glob patterns resolved by the runner.
  files:
    description: >
      Newline-separated list of file paths (or globs) to upload. Each
      matched file is uploaded as a separate PyPI distribution. Example:
        files: |
          dist/*.whl
          dist/*.tar.gz
    required: true

  # ── Optional ────────────────────────────────────────────────────────────────

  gitlab-host:
    description: >
      Base URL of the GitLab instance. Override for self-hosted GitLab.
    required: false
    default: 'https://gitlab.com'

  skip-existing:
    description: >
      When "true", pass --skip-existing to twine so files that already
      exist in the registry are silently skipped instead of failing the
      upload. Default "false".
    required: false
    default: 'false'

  twine-version:
    description: >
      Pin a specific twine version for reproducibility. Passed to
      `uvx --from twine==<ver>`. Leave empty to use the latest.
    required: false
    default: ''

outputs:

  registry-url:
    description: >
      URL of the PyPI package listing in the GitLab UI.
    value: >-
      ${{ inputs.gitlab-host }}/-/packages

  uploaded-files:
    description: Newline-separated list of files that twine successfully uploaded.
    value: ${{ steps.upload.outputs.uploaded_files }}

runs:
  using: 'composite'
  steps:

    # ── 1. Validate inputs ───────────────────────────────────────────────────
    - name: Validate inputs
      shell: bash
      run: |
        echo "::group::Validating inputs"

        error=0

        if [[ -z "${{ inputs.gitlab-username }}" ]]; then
          echo "::error::Input 'gitlab-username' must not be empty."
          error=1
        fi

        if [[ -z "${{ inputs.gitlab-token }}" ]]; then
          echo "::error::Input 'gitlab-token' must not be empty."
          error=1
        fi

        if [[ ! "${{ inputs.gitlab-project-id }}" =~ ^[0-9]+$ ]]; then
          echo "::error::Input 'gitlab-project-id' must be a numeric project ID."
          error=1
        fi

        SKIP_EXISTING="${{ inputs.skip-existing }}"
        if [[ "$SKIP_EXISTING" != "true" && "$SKIP_EXISTING" != "false" ]]; then
          echo "::error::Input 'skip-existing' must be 'true' or 'false'. Got: $SKIP_EXISTING"
          error=1
        fi

        if [[ $error -eq 1 ]]; then
          echo "::endgroup::"
          exit 1
        fi

        echo "All inputs validated successfully."
        echo "::endgroup::"

    # ── 2. Ensure uv is available (provides uvx for one-shot twine runs) ─────
    - name: Set up uv
      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
      with:
        enable-cache: false

    # ── 3. Resolve globs and upload via twine ────────────────────────────────
    - name: Upload files
      id: upload
      shell: bash
      env:
        TWINE_USERNAME: ${{ inputs.gitlab-username }}
        TWINE_PASSWORD: ${{ inputs.gitlab-token }}
        TWINE_REPOSITORY_URL: ${{ inputs.gitlab-host }}/api/v4/projects/${{ inputs.gitlab-project-id }}/packages/pypi
        TWINE_NON_INTERACTIVE: '1'
      run: |
        echo "::group::Resolving file globs"

        matched_files=()

        while IFS= read -r pattern; do
          [[ -z "$pattern" ]] && continue

          expanded=( $pattern )
          if [[ ${#expanded[@]} -eq 0 ]] || [[ ! -e "${expanded[0]}" ]]; then
            echo "::warning::Pattern '${pattern}' did not match any files — skipping."
            continue
          fi

          for filepath in "${expanded[@]}"; do
            if [[ ! -f "$filepath" ]]; then
              echo "::warning::'${filepath}' is not a regular file — skipping."
              continue
            fi
            matched_files+=("$filepath")
          done
        done <<< "${{ inputs.files }}"

        if [[ ${#matched_files[@]} -eq 0 ]]; then
          echo "::error::No files matched the provided globs; nothing to upload."
          echo "::endgroup::"
          exit 1
        fi

        printf 'Matched %d file(s):\n' "${#matched_files[@]}"
        printf '  %s\n' "${matched_files[@]}"

        echo "::endgroup::"
        echo "::group::Uploading via twine"

        twine_from='twine'
        if [[ -n "${{ inputs.twine-version }}" ]]; then
          twine_from="twine==${{ inputs.twine-version }}"
        fi

        skip_flag=''
        if [[ "${{ inputs.skip-existing }}" == 'true' ]]; then
          skip_flag='--skip-existing'
        fi

        uvx --from "$twine_from" twine upload \
          --disable-progress-bar \
          $skip_flag \
          "${matched_files[@]}"

        echo "::endgroup::"

        # Emit uploaded_files output
        {
          echo "uploaded_files<<EOF"
          printf '%s\n' "${matched_files[@]}"
          echo "EOF"
        } >> "$GITHUB_OUTPUT"

    # ── 4. Annotate the workflow run summary ─────────────────────────────────
    - name: Print registry URL
      shell: bash
      run: |
        echo "### GitLab PyPI Package Registry" >> "$GITHUB_STEP_SUMMARY"
        echo "" >> "$GITHUB_STEP_SUMMARY"
        echo "**Registry endpoint:** \`${{ inputs.gitlab-host }}/api/v4/projects/${{ inputs.gitlab-project-id }}/packages/pypi\`" >> "$GITHUB_STEP_SUMMARY"
        echo "" >> "$GITHUB_STEP_SUMMARY"
        echo "**Uploaded files:**" >> "$GITHUB_STEP_SUMMARY"
        while IFS= read -r f; do
          [[ -n "$f" ]] && echo "- \`$f\`" >> "$GITHUB_STEP_SUMMARY"
        done <<< "${{ steps.upload.outputs.uploaded_files }}"