publish.yml

name: Build and Publish to PyPI

on:
    # Trigger the workflow on push or pull request,
    # for the dev and any release branches
    push:
        branches:
            - dev
            - "release-**"
        tags:
            - "v*"
    pull_request:
        branches:
            - dev
            - "release-**"
    # Trigger the workflow for when a release is created
    release:
        types:
            - published

env:
    LC_ALL: en_US.UTF-8

defaults:
    run:
        shell: bash

permissions:
    contents: read

jobs:
    # Create release artifacts
    # - build source dist (tar ball) and wheel
    # - upload artifacts to GHA
    build-artifacts:
        name: Build artifacts
        runs-on: ubuntu-latest
        steps:
            - name: "Harden Runner"
              uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
              with:
                disable-sudo-and-containers: false
                egress-policy: block
                allowed-endpoints: >
                  github.com:443
                  registry-1.docker.io:443
                  production.cloudflare.docker.com:443
                  auth.docker.io:443
                  azure.archive.ubuntu.com:80
                  pypi.org:443
                  files.pythonhosted.org:443

            - name: Checkout code
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
              with:
                # for setuptools-scm
                fetch-depth: 0

            - name: Free disk space
              uses: ./.github/actions/free-disk-space

            - name: Setup Python 3.11
              uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
              with:
                python-version: "3.11"

            - name: Install dependencies
              run: |
                python -m pip install --upgrade pip
                pip install build cibuildwheel

            - name: Clean up release artifacts
              run: |
                rm -rf dist/

            - name: Build source distribution (no CUDA)
              run: |
                NO_CUDA_EXT=1 python -m build --sdist

            - name: Build CUDA wheels with cibuildwheel
              # Configuration is set in pyproject.toml
              run: |
                python -m cibuildwheel --output-dir dist

            - name: Upload release artifacts to GHA
              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
              with:
                name: release-artifacts
                path: dist/

    # Push to Test PyPI when:
    # - a new GitHub release is published
    # - a PR is merged into dev branch (push only trigger)
    publish-test-pypi:
        name: Publish packages to test.pypi.org
        if: |
            github.repository_owner == 'LMCache' && (
                github.event.action == 'published' ||
                (github.event_name == 'push' && github.ref == 'refs/heads/dev')
            )
        permissions:
            contents: read
            # see https://docs.pypi.org/trusted-publishers/
            id-token: write
        runs-on: ubuntu-latest
        needs: build-artifacts

        steps:
            - name: Harden Runner
              uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
              with:
                disable-sudo-and-containers: false
                egress-policy: block
                allowed-endpoints: >
                  ghcr.io:443
                  pkg-containers.githubusercontent.com:443
                  test.pypi.org:443
                  tuf-repo-cdn.sigstore.dev:443
                  fulcio.sigstore.dev:443
                  rekor.sigstore.dev:443

            - name: Fetch release artifacts
              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
              with:
                  name: release-artifacts
                  path: dist

            - name: Upload to Test PyPI
              uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
              with:
                  repository-url: https://test.pypi.org/legacy/
                  verbose: true

    # Push to PyPI (production) when:
    # - a new GitHub release is created
    publish-pypi:
        name: Publish release to pypi.org
        if: |
            github.repository_owner == 'LMCache' && github.event.action == 'published'
        permissions:
            # see https://docs.pypi.org/trusted-publishers/
            id-token: write
            # allow gh release upload
            contents: write

        runs-on: ubuntu-latest
        needs: build-artifacts

        steps:
            - name: Harden Runner
              uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
              with:
                  disable-sudo-and-containers: false
                  egress-policy: block
                  allowed-endpoints: >
                    api.github.com:443
                    uploads.github.com:443
                    ghcr.io:443
                    pkg-containers.githubusercontent.com:443
                    upload.pypi.org:443
                    tuf-repo-cdn.sigstore.dev:443
                    fulcio.sigstore.dev:443
                    rekor.sigstore.dev:443

            - name: Fetch release artifacts
              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
              with:
                  name: release-artifacts
                  path: dist

            - name: Upload release artifacts to GitHub release
              env:
                  GITHUB_TOKEN: ${{ github.token }}
              run: >-
                  gh release upload '${{ github.ref_name }}' dist/* --repo '${{ github.repository }}'

            - name: Upload to PyPI
              uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
              with:
                verbose: true

    # Build container image and push to DockerHub when:
    # - a new GitHub release is created
    publish-image:
        name: Publish image to DockerHub
        if: |
            github.repository_owner == 'LMCache' && github.event.action == 'published'

        runs-on: ubuntu-latest
        needs: publish-pypi

        steps:
            - name: "Harden Runner"
              uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
              with:
                disable-sudo-and-containers: false
                egress-policy: block
                allowed-endpoints: >
                  github.com:443
                  registry-1.docker.io:443
                  production.cloudflare.docker.com:443
                  auth.docker.io:443
                  azure.archive.ubuntu.com:80
                  archive.ubuntu.com:80
                  security.ubuntu.com:80
                  astral.sh:443
                  objects.githubusercontent.com:443
                  pypi.org:443
                  files.pythonhosted.org:443
                  release-assets.githubusercontent.com:443
                  wrapdb.mesonbuild.com:443
                  nvcr.io:443
                  layers.nvcr.io:443

            - name: Login to DockerHub
              uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
              with:
                username: ${{ vars.DOCKERHUB_USERNAME }}
                password: ${{ secrets.DOCKERHUB_TOKEN }}

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

            - name: Checkout code
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
              with:
                # for setuptools-scm
                fetch-depth: 0

            - name: Free disk space
              uses: ./.github/actions/free-disk-space

            - name: Get the latest tag (corresponds to release cut in publish-pypi job)
              run: |
                echo "LATEST_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_ENV"

            - name: Build lmcache/vllm-openai container image with latest releases
              run: |
                docker build \
                --build-arg CUDA_VERSION=12.8 --build-arg UBUNTU_VERSION=24.04 \
                --target image-release \
                --tag lmcache/vllm-openai:latest --tag lmcache/vllm-openai:${{ env.LATEST_TAG }} \
                --file docker/Dockerfile .

            - name: Push lmcache/vllm-openai container image to DockerHub
              run: |
                docker push lmcache/vllm-openai:latest
                docker push lmcache/vllm-openai:${{ env.LATEST_TAG }}