python-nightly.yml

name: python-publish

on:
  schedule:
    - cron: '17 8 * * *'
  workflow_dispatch:
    inputs:
      channel:
        description: Package channel to publish
        required: true
        default: nightly
        type: choice
        options:
          - nightly
          - stable
      expected_version:
        description: Exact source version to publish (required for stable)
        required: false
        type: string
      smoke_tested_commit:
        description: Full master commit SHA smoke-tested on a test cluster (required for stable)
        required: false
        type: string

concurrency:
  group: python-publish-${{ inputs.channel || 'nightly' }}
  cancel-in-progress: false

permissions:
  contents: read

env:
  NIGHTLY_VERSION: 0.3.1

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      channel: ${{ steps.version.outputs.channel }}
      version: ${{ steps.version.outputs.version }}
      commit: ${{ steps.version.outputs.commit }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ github.sha }}
          persist-credentials: false

      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
        with:
          python-version: '3.12'

      - name: Install pinned pip
        run: python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

      - name: Select the publication version
        id: version
        env:
          DISPATCH_CHANNEL: ${{ inputs.channel }}
        run: |
          commit="$(git rev-parse HEAD)"
          test "$commit" = "$GITHUB_SHA"
          source_version="$(python -c 'import cmax; print(cmax.__version__)')"
          channel="${DISPATCH_CHANNEL:-nightly}"
          case "$channel" in
            stable)
              version="$source_version"
              ;;
            nightly)
              date_utc="$(date -u +%Y%m%d)"
              version="$(python .github/scripts/nightly_version.py \
                --release-version "$NIGHTLY_VERSION" \
                --date "$date_utc" \
                --run-number "$GITHUB_RUN_NUMBER")"
              ;;
            *)
              echo "Unknown publication channel: $channel" >&2
              exit 1
              ;;
          esac
          echo "channel=$channel" >> "$GITHUB_OUTPUT"
          echo "commit=$commit" >> "$GITHUB_OUTPUT"
          echo "source_version=$source_version" >> "$GITHUB_OUTPUT"
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "### ClusterMAX publication" >> "$GITHUB_STEP_SUMMARY"
          echo "- Channel: \`$channel\`" >> "$GITHUB_STEP_SUMMARY"
          echo "- Version: \`$version\`" >> "$GITHUB_STEP_SUMMARY"
          echo "- Commit: \`$commit\`" >> "$GITHUB_STEP_SUMMARY"

      - name: Check stable publication inputs and collisions
        if: steps.version.outputs.channel == 'stable'
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_CHANNEL: ${{ steps.version.outputs.channel }}
          EXPECTED_VERSION: ${{ inputs.expected_version }}
          SMOKE_TESTED_COMMIT: ${{ inputs.smoke_tested_commit }}
          VERSION: ${{ steps.version.outputs.version }}
          COMMIT: ${{ steps.version.outputs.commit }}
        run: |
          python .github/scripts/stable_release.py preflight --version "$VERSION" --commit "$COMMIT"
          test -s "docs/releases/${VERSION}.md"

      - name: Test the exact stable commit
        if: steps.version.outputs.channel == 'stable'
        run: |
          python -m pip install pytest pytest-xdist pyyaml prompt-toolkit packaging
          python -m pytest -q

      - name: Build the distributions
        env:
          CLUSTERMAX_BUILD_VERSION: ${{ steps.version.outputs.version }}
          SOURCE_VERSION: ${{ steps.version.outputs.source_version }}
        run: |
          python -m pip install \
            --require-hashes \
            --only-binary=:all: \
            --disable-pip-version-check \
            -r .github/requirements/release.txt
          python -m build --no-isolation
          python -m twine check dist/*
          check-wheel-contents dist/clustermax-*.whl
          test "$(python -c 'import cmax; print(cmax.__version__)')" = "$SOURCE_VERSION"

      - name: Verify the wheel
        env:
          EXPECTED_VERSION: ${{ steps.version.outputs.version }}
        run: |
          python -m venv /tmp/clustermax-publication
          /tmp/clustermax-publication/bin/python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
          /tmp/clustermax-publication/bin/pip install dist/clustermax-*.whl
          cd /tmp
          test "$(/tmp/clustermax-publication/bin/cmax --version)" = "cmax ${EXPECTED_VERSION}"
          /tmp/clustermax-publication/bin/cmax audit --show
          /tmp/clustermax-publication/bin/cmax audit security --show

      - name: Bind artifacts and release notes to the commit
        env:
          VERSION: ${{ steps.version.outputs.version }}
          COMMIT: ${{ steps.version.outputs.commit }}
          RELEASE_CHANNEL: ${{ steps.version.outputs.channel }}
        run: |
          mkdir -p publication/dist
          cp dist/* publication/dist/
          args=()
          if [[ "$RELEASE_CHANNEL" == stable ]]; then
            args+=(--notes "docs/releases/${VERSION}.md")
          fi
          python .github/scripts/stable_release.py prepare \
            --version "$VERSION" --commit "$COMMIT" "${args[@]}"

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: clustermax-${{ steps.version.outputs.version }}-${{ steps.version.outputs.commit }}
          path: publication/
          if-no-files-found: error
          retention-days: ${{ steps.version.outputs.channel == 'stable' && 90 || 14 }}

  publish:
    if: github.repository == 'SemiAnalysisAI/ClusterMAX' && github.ref == 'refs/heads/master'
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: ${{ needs.build.outputs.channel == 'nightly' && 'pypi-nightly' || 'pypi' }}
      url: https://pypi.org/project/clustermax/
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
        with:
          python-version: '3.12'
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: clustermax-${{ needs.build.outputs.version }}-${{ needs.build.outputs.commit }}
          path: publication/

      - name: Verify the approved artifacts
        env:
          VERSION: ${{ needs.build.outputs.version }}
          COMMIT: ${{ github.sha }}
          RELEASE_CHANNEL: ${{ needs.build.outputs.channel }}
        run: |
          args=()
          if [[ "$RELEASE_CHANNEL" == stable ]]; then args+=(--stable); fi
          python .github/scripts/stable_release.py verify \
            --version "$VERSION" --commit "$COMMIT" "${args[@]}"

      - name: Recheck stable publication after approval
        if: needs.build.outputs.channel == 'stable'
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_CHANNEL: ${{ needs.build.outputs.channel }}
          EXPECTED_VERSION: ${{ inputs.expected_version }}
          SMOKE_TESTED_COMMIT: ${{ inputs.smoke_tested_commit }}
          VERSION: ${{ needs.build.outputs.version }}
          COMMIT: ${{ github.sha }}
        run: |
          python .github/scripts/stable_release.py preflight --version "$VERSION" --commit "$COMMIT"

      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
        with:
          packages-dir: publication/dist/

  verify-pypi:
    if: >-
      github.repository == 'SemiAnalysisAI/ClusterMAX' &&
      github.ref == 'refs/heads/master' &&
      github.event_name == 'workflow_dispatch' &&
      needs.build.outputs.channel == 'stable'
    needs: [build, publish]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
        with:
          python-version: '3.12'
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: clustermax-${{ needs.build.outputs.version }}-${{ needs.build.outputs.commit }}
          path: publication/
      - name: Verify PyPI hashes and download the published wheel
        env:
          VERSION: ${{ needs.build.outputs.version }}
          COMMIT: ${{ github.sha }}
        run: |
          python .github/scripts/stable_release.py verify-pypi \
            --version "$VERSION" --commit "$COMMIT"
      - name: Smoke-test the wheel fetched from PyPI
        env:
          VERSION: ${{ needs.build.outputs.version }}
        run: |
          python -m venv /tmp/clustermax-from-pypi
          /tmp/clustermax-from-pypi/bin/python -m pip --isolated install \
            --index-url https://pypi.org/simple --no-cache-dir \
            "/tmp/clustermax-pypi-wheel/clustermax-${VERSION}-py3-none-any.whl"
          cd /tmp
          test "$(/tmp/clustermax-from-pypi/bin/cmax --version)" = "cmax ${VERSION}"
          /tmp/clustermax-from-pypi/bin/cmax audit --show
          /tmp/clustermax-from-pypi/bin/cmax audit security --show
          /tmp/clustermax-from-pypi/bin/cmax audit security --standalone --dry-run -o yaml

  github-release:
    if: >-
      github.repository == 'SemiAnalysisAI/ClusterMAX' &&
      github.ref == 'refs/heads/master' &&
      github.event_name == 'workflow_dispatch' &&
      needs.build.outputs.channel == 'stable'
    needs: [build, verify-pypi]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
        with:
          python-version: '3.12'
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: clustermax-${{ needs.build.outputs.version }}-${{ needs.build.outputs.commit }}
          path: publication/
      - name: Create or resume the matching GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_CHANNEL: ${{ needs.build.outputs.channel }}
          VERSION: ${{ needs.build.outputs.version }}
          COMMIT: ${{ github.sha }}
        run: |
          python .github/scripts/stable_release.py github-release \
            --version "$VERSION" --commit "$COMMIT"