release.yaml

name: CI and Release on main

on:
  push:
    branches:
      - main

jobs:
  ci:
    name: CI
    uses: ./.github/workflows/ci.yaml

  release:
    name: Release
    runs-on: ubuntu-latest
    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}
      cancel-in-progress: true
    needs: ci
    permissions:
      id-token: write
      contents: write
    environment:
      name: pypi
      url: https://pypi.org/p/vertex-deployer

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
        token: ${{ secrets.RELEASE_ACCESS_TOKEN }}

    - name: Python Semantic Release
      id: python-semantic-release
      uses: python-semantic-release/python-semantic-release@v9.11.0
      with:
        github_token: ${{ secrets.RELEASE_ACCESS_TOKEN }}

    # Publish to Pypi
    - name: Publish package distributions to PyPI
      if: steps.python-semantic-release.outputs.released == 'true'
      uses: pypa/gh-action-pypi-publish@release/v1

    # Publish to Google Artifact Registry
    - name: 'Authenticate to Google Cloud'
      if: steps.python-semantic-release.outputs.released == 'true'
      uses: 'google-github-actions/auth@v2'
      with:
        token_format: 'access_token'
        workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider
        service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - my-service-account@my-project.iam.gserviceaccount.com

    - name: Install twine
      if: steps.python-semantic-release.outputs.released == 'true'
      run: pip install twine keyrings.google-artifactregistry-auth

    - name: Upload dist to Google Artifact Registry
      if: steps.python-semantic-release.outputs.released == 'true'
      run: |
        python3 -m twine upload \
          --repository-url https://europe-west1-python.pkg.dev/data-sandbox-fr/artefactory \
          --verbose \
          dist/*