SDK PyPI Release #15
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SDK PyPI Release | |
| # Publishes smbcloud-sdk-auth (sdk/python) to PyPI. | |
| # Triggered by the crates release workflow when wrapped Rust crates change, | |
| # or manually via workflow_dispatch. | |
| # | |
| # Windows arm64 wheels are intentionally not built here. GitHub's hosted | |
| # Windows runners provide x64 Python, and maturin refuses to build an arm64 | |
| # wheel when the interpreter reports win-amd64. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Release tag (e.g. v0.3.35)" | |
| required: true | |
| permissions: | |
| id-token: write | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CLI_CLIENT_SECRET: ${{ secrets.CLI_CLIENT_SECRET }} | |
| jobs: | |
| build-wheels: | |
| name: Build PyPI wheels | |
| runs-on: ${{ matrix.build.OS }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| build: | |
| - { | |
| NAME: linux-x64-glibc, | |
| OS: ubuntu-latest, | |
| TARGET: x86_64-unknown-linux-gnu, | |
| MANYLINUX: "2014", | |
| } | |
| - { | |
| NAME: linux-arm64-glibc, | |
| OS: ubuntu-24.04-arm, | |
| TARGET: aarch64-unknown-linux-gnu, | |
| MANYLINUX: "2014", | |
| } | |
| - { | |
| NAME: win32-x64-msvc, | |
| OS: windows-2022, | |
| TARGET: x86_64-pc-windows-msvc, | |
| } | |
| - { | |
| NAME: darwin-x64, | |
| OS: macos-15-intel, | |
| TARGET: x86_64-apple-darwin, | |
| } | |
| - { | |
| NAME: darwin-arm64, | |
| OS: macos-latest, | |
| TARGET: aarch64-apple-darwin, | |
| } | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.event.inputs.tag || github.ref }} | |
| - name: Set the release version | |
| shell: bash | |
| run: | | |
| if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then | |
| release_version="${GITHUB_REF_NAME#v}" | |
| else | |
| release_version="${{ github.event.inputs.tag }}" | |
| release_version="${release_version#v}" | |
| fi | |
| echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV" | |
| - name: Read Rust toolchain | |
| shell: bash | |
| run: | | |
| rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)" | |
| if [ -z "$rust_toolchain" ]; then | |
| echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2 | |
| exit 1 | |
| fi | |
| echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV" | |
| - name: Install toolkit | |
| uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 | |
| with: | |
| toolchain: ${{ env.RUST_TOOLCHAIN }} | |
| - name: Install Rust target | |
| shell: bash | |
| run: | | |
| rustup target add ${{ matrix.build.TARGET }} --toolchain ${{ env.RUST_TOOLCHAIN }} | |
| rustup target list --installed | |
| - name: Verify Cargo.toml version matches tag | |
| shell: bash | |
| run: | | |
| CARGO_VERSION=$(cargo metadata --no-deps --format-version 1 \ | |
| | jq -r '.packages[] | select(.name == "smbcloud-auth-sdk-py") | .version') | |
| echo "Cargo.toml version : ${CARGO_VERSION}" | |
| echo "Release tag version: ${RELEASE_VERSION}" | |
| if [[ "${CARGO_VERSION}" != "${RELEASE_VERSION}" ]]; then | |
| echo "::error::Version mismatch — bump version in crates/smbcloud-auth-sdk-py/Cargo.toml before releasing." | |
| exit 1 | |
| fi | |
| - name: Setup Rust cache | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: sdk-pypi-${{ matrix.build.NAME }} | |
| # manylinux containers are CentOS-based and use yum; perl-core is required | |
| # by the openssl-sys vendored build to compile OpenSSL from source. | |
| - name: Clean dist directory | |
| shell: bash | |
| run: rm -rf sdk/python/dist | |
| - name: Build wheel | |
| uses: PyO3/maturin-action@v1 | |
| with: | |
| target: ${{ matrix.build.TARGET }} | |
| manylinux: ${{ matrix.build.MANYLINUX || 'off' }} | |
| working-directory: sdk/python | |
| args: --release --locked --compatibility pypi --out dist | |
| before-script-linux: yum install -y perl-core | |
| docker-options: -e CLI_CLIENT_SECRET | |
| - name: Upload wheel artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: wheels-${{ matrix.build.NAME }} | |
| path: sdk/python/dist/* | |
| build-sdist: | |
| name: Build source distribution | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.event.inputs.tag || github.ref }} | |
| - name: Set the release version | |
| shell: bash | |
| run: | | |
| if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then | |
| release_version="${GITHUB_REF_NAME#v}" | |
| else | |
| release_version="${{ github.event.inputs.tag }}" | |
| release_version="${release_version#v}" | |
| fi | |
| echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV" | |
| - name: Read Rust toolchain | |
| shell: bash | |
| run: | | |
| rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)" | |
| if [ -z "$rust_toolchain" ]; then | |
| echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2 | |
| exit 1 | |
| fi | |
| echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV" | |
| - name: Install toolkit | |
| uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 | |
| with: | |
| toolchain: ${{ env.RUST_TOOLCHAIN }} | |
| - name: Clean dist directory | |
| run: rm -rf sdk/python/dist | |
| - name: Build sdist | |
| uses: PyO3/maturin-action@v1 | |
| with: | |
| command: sdist | |
| working-directory: sdk/python | |
| args: --out dist | |
| - name: Upload sdist artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: sdist | |
| path: sdk/python/dist/* | |
| publish-pypi: | |
| name: Publish to PyPI | |
| runs-on: ubuntu-latest | |
| needs: | |
| - build-wheels | |
| - build-sdist | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.event.inputs.tag || github.ref }} | |
| - name: Set the release version | |
| shell: bash | |
| run: | | |
| if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then | |
| release_version="${GITHUB_REF_NAME#v}" | |
| else | |
| release_version="${{ github.event.inputs.tag }}" | |
| release_version="${release_version#v}" | |
| fi | |
| echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV" | |
| - name: Download distribution artifacts | |
| uses: actions/download-artifact@v7 | |
| with: | |
| pattern: "*" | |
| path: dist | |
| merge-multiple: true | |
| - name: Check whether release already exists on PyPI | |
| id: pypi-check | |
| shell: bash | |
| run: | | |
| if curl -fsS "https://pypi.org/pypi/smbcloud-sdk-auth/${RELEASE_VERSION}/json" >/dev/null 2>&1; then | |
| echo "smbcloud-sdk-auth ${RELEASE_VERSION} already exists on PyPI, skipping publish" | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Publish distribution | |
| if: steps.pypi-check.outputs.exists != 'true' | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| skip-existing: true |