ozi.yml

name: OZI

on:
  push:
    branches:
      - "v?[0-9].[0-9]*"
      - "v?[1-9]+[0-9].[0-9]*"

permissions:
  contents: read

jobs:


  checkpoint-cp310-ubuntu-latest:
    name: checkpoint (Python 3.10 on ubuntu-latest)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    permissions:
        id-token: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            api.github.com:443
            oziproject.dev:443
            www.oziproject.dev:443
            pypi.org:443
            registry.npmjs.org:443
            objects.github.com:443
            fulcio.sigstore.dev:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443

      - uses: OZI-Project/checkpoint@84a85f725520d5661ed417915ccb0e769973879c # 1.5.4
        with:
          python-version: "3.10"

  checkpoint-cp311-ubuntu-latest:
    name: checkpoint (Python 3.11 on ubuntu-latest)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    permissions:
        id-token: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            api.github.com:443
            oziproject.dev:443
            www.oziproject.dev:443
            pypi.org:443
            registry.npmjs.org:443
            objects.github.com:443
            fulcio.sigstore.dev:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443

      - uses: OZI-Project/checkpoint@84a85f725520d5661ed417915ccb0e769973879c # 1.5.4
        with:
          python-version: "3.11"

  checkpoint-cp312-ubuntu-latest:
    name: checkpoint (Python 3.12 on ubuntu-latest)
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    permissions:
        id-token: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            api.github.com:443
            oziproject.dev:443
            www.oziproject.dev:443
            pypi.org:443
            registry.npmjs.org:443
            objects.github.com:443
            fulcio.sigstore.dev:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443

      - uses: OZI-Project/checkpoint@84a85f725520d5661ed417915ccb0e769973879c # 1.5.4
        with:
          python-version: "3.12"


  checkpoint:
    runs-on: ubuntu-latest
    needs: [checkpoint-cp310-ubuntu-latest,checkpoint-cp311-ubuntu-latest,checkpoint-cp312-ubuntu-latest,]
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          disable-sudo: true
          egress-policy: block


  draft:
    needs: checkpoint
    runs-on: ubuntu-latest
    concurrency: draft
    strategy:
      fail-fast: true
    permissions:
      contents: write
      id-token: write
    outputs:
      drafted: ${{ steps.draft.outputs.drafted }}
      tag: ${{ steps.draft.outputs.tag }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443

      - uses: OZI-Project/draft@31451b7f6a49b6ef70270b59ff70585d76677012 # 1.9.0
        id: draft
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}


  release:
    needs: [draft, checkpoint]
    runs-on: ubuntu-latest
    concurrency: release
    strategy:
      fail-fast: true
      max-parallel: 1
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            fulcio.sigstore.dev:443
            github.com:443
            pypi.org:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443
            oziproject.dev:443
            www.oziproject.dev:443
            objects.github.com:443
            quay.io:443
            cdn03.quay.io:443
            downloads.python.org:443

      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: security2

      - name: Install build dependencies
        run: |
            python -m pip install --user -r requirements.txt
            pipx ensurepath --force
            pipx install meson --force

      - name: Configure git repository
        run: |
            git config --global user.email "noreply@oziproject.dev"
            git config --global user.name "OZI Packaging"
            rm -rf .git/COMMIT_EDITMSG

      - name: Hiding README.rst symlink from SCM
        continue-on-error: true
        run: |
            git update-index --skip-worktree README.rst

      - name: Hiding README.md symlink from SCM
        continue-on-error: true
        run: |
            git update-index --skip-worktree README.md

      - name: Hiding README.txt symlink from SCM
        continue-on-error: true
        run: |
            git update-index --skip-worktree README.txt
  
      - name: Hiding assets folder from SCM
        run: |
            git update-index --skip-worktree doc/assets/brand

      - name: Publish release
        run: |
            git diff
            python -m build .

      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          include-hidden-files: true
          path: |
            !*-checkpoint/
            !.git/config
            !signing-artifacts-*/
            !security2/
            !build/
            ./

  publish:
    runs-on: ubuntu-latest
    needs: [draft, release]
    if: needs.draft.outputs.drafted == 'true'
    permissions:
      contents: write
      id-token: write
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
      with:
        disable-sudo: true
        egress-policy: block
        allowed-endpoints: >
          github.com:443
          api.github.com:443
          upload.pypi.org:443
          uploads.github.com:443
          rekor.sigstore.dev:443
          tuf-repo-cdn.sigstore.dev:443
          fulcio.sigstore.dev:443
          ghcr.io:443
          pkg-containers.githubusercontent.com:443

    - uses: OZI-Project/publish@c35059a13b64575387092e163fa91c2a9f5019da # 1.9.3
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}

    - name: Publish package distributions to PyPI
      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc