release-chromadb.yml

name: 📦 Release chromadb to PyPI and DockerHub

on:
  push:
    tags:
      - "*"
    branches:
      - main

env:
  GHCR_IMAGE_NAME: "ghcr.io/chroma-core/chroma"
  DOCKERHUB_IMAGE_NAME: "chromadb/chroma"
  PLATFORMS: linux/amd64,linux/arm64 #linux/riscv64, linux/arm/v7

jobs:
  check-tag:
    runs-on: ubuntu-latest
    outputs:
      tag_matches: ${{ steps.check-tag.outputs.tag_matches }}
    steps:
      - name: Check Tag
        id: check-tag
        run: |
          if [[ ${{ github.event.ref }} =~ ^refs/tags/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "tag_matches=true" >> $GITHUB_OUTPUT
          else
            echo "Tag does not match the release tag pattern ([0-9]+\.[0-9]+\.[0-9]+), exiting workflow"
            echo "tag_matches=false" >> $GITHUB_OUTPUT
          fi

  get-version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.9'
      - name: Install setuptools_scm
        run: python -m pip install setuptools_scm
      - name: Get Release Version
        id: version
        run: echo "version=$(python -m setuptools_scm)" >> $GITHUB_OUTPUT

  python-tests:
    uses: ./.github/workflows/_python-tests.yml
    with:
      python_versions: '["3.9", "3.10", "3.11", "3.12"]'
      property_testing_preset: 'normal'

  javascript-client-tests:
    name: JavaScript client tests
    uses: ./.github/workflows/_javascript-client-tests.yml

  rust-tests:
    name: Rust tests
    uses: ./.github/workflows/_rust-tests.yml

  go-tests:
    name: Go tests
    uses: ./.github/workflows/_go-tests.yml

  release-docker:
    name: Publish to DockerHub and GHCR
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      packages: write
    needs:
      - check-tag
      - get-version
      - python-tests
      - javascript-client-tests
      - rust-tests
      - go-tests
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up Docker
        uses: ./.github/actions/docker
        with:
          ghcr-username: ${{ github.actor }}
          ghcr-password: ${{ secrets.GITHUB_TOKEN }}
          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Set up Depot CLI
        uses: depot/setup-action@v1
      - name: Build and push prerelease Docker image
        if: ${{ needs.check-tag.outputs.tag_matches != 'true' }}
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: ${{ env.PLATFORMS }}
          push: true
          tags: "${{ env.GHCR_IMAGE_NAME }}:${{ needs.get-version.outputs.version}},${{ env.DOCKERHUB_IMAGE_NAME }}:${{ needs.get-version.outputs.version }}"
          project: ${{ vars.DEPOT_PROJECT_ID }}
      - name: Build and push release Docker image
        if: ${{ needs.check-tag.outputs.tag_matches == 'true' }}
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: ${{ env.PLATFORMS }}
          push: true
          tags: "${{ env.GHCR_IMAGE_NAME }}:${{ needs.get-version.outputs.version }},${{ env.DOCKERHUB_IMAGE_NAME }}:${{ needs.get-version.outputs.version }},${{ env.GHCR_IMAGE_NAME }}:latest,${{ env.DOCKERHUB_IMAGE_NAME }}:latest"
          project: ${{ vars.DEPOT_PROJECT_ID }}

  release-pypi:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    needs:
      - check-tag
      - get-version
      - python-tests
      - javascript-client-tests
      - rust-tests
      - go-tests
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Python
        uses: ./.github/actions/python
        with:
          python-version: '3.10'
      - name: Build Client
        run: python -m build
      - name: Test Client Package
        run: bin/test-package/test-package.sh dist/*.tar.gz
      - name: Upload as artifact
        uses: actions/upload-artifact@v4
        with:
          name: "built-chromadb-package"
          path: "dist/chromadb-${{needs.get-version.outputs.version}}.tar.gz"
      - name: Publish to Test PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
          repository-url: https://test.pypi.org/legacy/
          verbose: 'true'
      - name: Publish to PyPI
        if: ${{ needs.check-tag.outputs.tag_matches == 'true' }}
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}
          verbose: 'true'

  release-thin-pypi:
    name: Publish thin client to PyPI
    runs-on: ubuntu-latest
    needs:
      - check-tag
      - python-tests
      - javascript-client-tests
      - rust-tests
      - go-tests
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up Python
        uses: ./.github/actions/python
        with:
          python-version: '3.12'
      - name: Build Client
        run: ./clients/python/build_python_thin_client.sh
      - name: Test Client Package
        run: bin/test-package/test-thin-client-package.sh dist/*.tar.gz
      - name: Install setuptools_scm
        run: python -m pip install setuptools_scm
      - name: Publish to Test PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.TEST_PYPI_PYTHON_CLIENT_PUBLISH_KEY }}
          repository-url: https://test.pypi.org/legacy/
          verbose: 'true'
      - name: Publish to PyPI
        if:  ${{ needs.check-tag.outputs.tag_matches == 'true' }}
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_PYTHON_CLIENT_PUBLISH_KEY }}
          verbose: 'true'

  release-github:
    name: Make GitHub release
    runs-on: ubuntu-latest
    needs:
      - check-tag
      - get-version
      - release-docker
      - release-pypi
      - release-thin-pypi
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: built-chromadb-package
          path: dist
      - name: Get current date
        id: builddate
        run: echo "builddate=$(date +'%Y-%m-%dT%H:%M')" >> $GITHUB_OUTPUT
      - name: Release Tagged Version
        uses: ncipollo/release-action@v1.14.0
        if: ${{ needs.check-tag.outputs.tag_matches == 'true' }}
        with:
          body: |
            Version: `${{needs.get-version.outputs.version}}`
            Git ref: `${{github.ref}}`
            Build Date: `${{steps.builddate.outputs.builddate}}`
            PIP Package: `chroma-${{needs.get-version.outputs.version}}.tar.gz`
            Github Container Registry Image: `${{ env.GHCR_IMAGE_NAME }}:${{ needs.get-version.outputs.version }}`
            DockerHub Image: `${{ env.DOCKERHUB_IMAGE_NAME }}:${{ needs.get-version.outputs.version }}`
          artifacts: "dist/chromadb-${{needs.get-version.outputs.version}}.tar.gz"
          prerelease: false
          makeLatest: true
          generateReleaseNotes: true
      - name: Update Tag
        uses: richardsimko/update-tag@v1.0.5
        if: ${{ needs.check-tag.outputs.tag_matches != 'true' }}
        with:
          tag_name: latest
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Release Latest
        uses: ncipollo/release-action@v1.14.0
        if: ${{ needs.check-tag.outputs.tag_matches != 'true' }}
        with:
          tag: "latest"
          name: "Latest"
          body: |
            Version: `${{needs.get-version.outputs.version}}`
            Git ref: `${{github.ref}}`
            Build Date: `${{steps.builddate.outputs.builddate}}`
            PIP Package: `chroma-${{needs.get-version.outputs.version}}.tar.gz`
            Github Container Registry Image: `${{ env.GHCR_IMAGE_NAME }}:${{ needs.get-version.outputs.version }}`
            DockerHub Image: `${{ env.DOCKERHUB_IMAGE_NAME }}:${{ needs.get-version.outputs.version }}`
          artifacts: "dist/chromadb-${{needs.get-version.outputs.version}}.tar.gz"
          allowUpdates: true
          removeArtifacts: true
          prerelease: true

  release-hosted:
    name: Release to Chroma Cloud
    runs-on: ubuntu-latest
    needs:
      - release-github
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Dispatch deploy
        uses: actions/github-script@v6
        with:
          github-token: ${{ secrets.HOSTED_CHROMA_WORKFLOW_DISPATCH_TOKEN }}
          script: |
            const result = await github.rest.actions.createWorkflowDispatch({
              owner: 'chroma-core',
              repo: 'hosted-chroma',
              workflow_id: 'deploy.yaml',
              ref: 'main',
              inputs: {
                // We intentionally *do not* provide the current commit SHA of chroma-core/chroma here. The workflow we dispatch defaults to the commit tagged with "latest" (which we update above).
                // If we provided the current commit here, there's a potential race condition:
                // - Commit history is A -> B
                // - This CI workflow runs on both commits, but the second commit finishes first
                // - B is deployed to Chroma Cloud
                // - This workflow finishes for A and deploys A to Chroma Cloud
                // Chroma Cloud is now running A, but the last commit was B.
                "environment": "staging",
                "planes": "data"
              }
            })

  release-docs:
    name: Deploy docs to Vercel
    runs-on: ubuntu-latest
    needs:
      - check-tag
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v3
        with:
          node-version: "18.x"
          registry-url: "https://registry.npmjs.org"
      - name: Install vercel
        run: npm install -g vercel
      - name: Deploy
        run: vercel deploy --token ${{ secrets.VERCEL_TOKEN }} ${{ needs.check-tag.outputs.tag_matches == 'true' && '--prod' || '' }}
        env:
          VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_DOCS_PROJECT_ID }}