publish_internal.yml

name: Build and upload to internal PyPI

on:
  workflow_dispatch: # run on request (no need for PR)

# Declare default permissions as read only.
permissions: read-all

jobs:
  build_wheels:
    name: Build wheels
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Build wheels
        uses: pypa/cibuildwheel@ce3fb7832089eb3e723a0a99cab7f3eaccf074fd # v2.16.5
      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
        with:
          name: artifact-wheels
          path: ./wheelhouse/*.whl

  build_sdist:
    name: Build source distribution
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set up Python 3.10
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
        with:
          python-version: "3.10"
      - name: Install pypa/build
        run: |
          pip install --require-hashes --no-deps -r requirements/gh-actions.txt
          pip-compile --generate-hashes -o /tmp/otx-publish-requirements.txt requirements/publish.txt
          pip install --require-hashes --no-deps -r /tmp/otx-publish-requirements.txt
          rm /tmp/otx-publish-requirements.txt
      - name: Build sdist
        run: python -m build --sdist
      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
        with:
          name: artifact-sdist
          path: dist/*.tar.gz

  publish_package:
    name: Publish package
    needs: [build_wheels, build_sdist]
    environment: pypi
    runs-on: [self-hosted, linux, x64, dev]
    permissions:
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set up Python
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
        with:
          python-version: "3.10"
      - name: Install dependencies
        run: |
          pip install --require-hashes --no-deps -r requirements/gh-actions.txt
          pip-compile --generate-hashes -o /tmp/otx-publish-requirements.txt requirements/publish.txt
          pip install --require-hashes --no-deps -r /tmp/otx-publish-requirements.txt
          rm /tmp/otx-publish-requirements.txt
      - name: Download artifacts
        uses: actions/download-artifact@87c55149d96e628cc2ef7e6fc2aab372015aec85 # v4.1.3
        with:
          # unpacks default artifact into dist/
          # if `name: artifact` is omitted, the action will create extra parent dir
          path: dist
          pattern: artifact-*
          merge-multiple: true
      - name: Check tag
        id: check-tag
        uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2.0.2
        with:
          text: ${{ github.ref }}
          regex: '^refs/heads/releases/[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+rc[0-9]+|rc[0-9]+)?$'
      - name: Check dist contents
        run: twine check dist/*
      - name: Publish package dist to internal PyPI
        if: ${{ steps.check-tag.outputs.match != '' }}
        run: |
          export no_proxy=${{ secrets.PYPI_HOST }}
          export REPOSITORY_URL=http://${{ secrets.PYPI_HOST }}:${{ secrets.PYPI_PORT }}
          twine upload --verbose --repository-url $REPOSITORY_URL dist/* -u ${{ secrets.PYPI_USER }} -p ${{ secrets.PYPI_PASSWORD }}
      - name: Publish package distributions to TestPyPI
        if: ${{ steps.check-tag.outputs.match == '' }}
        run: |
          export REPOSITORY_URL=https://test.pypi.org/legacy/
          twine upload --verbose --repository-url $REPOSITORY_URL dist/* -u __token__ -p ${{ secrets.TEST_PYPI_API_TOKEN }}
      - name: Clean up dist
        if: ${{ always() }}
        run: |
          if OUTPUT=$(ls | grep -c dist)
          then
            echo "Cleaning up dist directory"
            rm -r dist
          fi