392 lines
20 KiB
YAML
392 lines
20 KiB
YAML
name: publish-dlp-io
|
||
|
||
# Publish the standalone dlp-io distribution from an immutable dlp-io-vX.Y.Z tag.
|
||
# The Windows runner cannot reach github.com, so this workflow uses no third-party actions.
|
||
|
||
on:
|
||
push:
|
||
tags:
|
||
- "dlp-io-v*.*.*"
|
||
workflow_dispatch:
|
||
inputs:
|
||
version:
|
||
description: "Immutable package tag, for example dlp-io-v0.1.0"
|
||
required: true
|
||
type: string
|
||
|
||
env:
|
||
PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
|
||
|
||
jobs:
|
||
publish:
|
||
runs-on: windows-latest
|
||
defaults:
|
||
run:
|
||
working-directory: repo
|
||
steps:
|
||
- name: Clone immutable package tag
|
||
shell: pwsh
|
||
working-directory: .
|
||
env:
|
||
ACTION_EVENT_NAME: ${{ github.event_name }}
|
||
ACTION_REF_NAME: ${{ github.ref_name }}
|
||
ACTION_SERVER_URL: ${{ github.server_url }}
|
||
ACTION_REPOSITORY: ${{ github.repository }}
|
||
ACTION_CLONE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||
DLP_IO_INPUT_VERSION: ${{ inputs.version }}
|
||
run: |
|
||
$ErrorActionPreference = "Stop"
|
||
$tag = if ($env:ACTION_EVENT_NAME -eq "workflow_dispatch") {
|
||
$env:DLP_IO_INPUT_VERSION
|
||
} else {
|
||
$env:ACTION_REF_NAME
|
||
}
|
||
if ($tag -notmatch '^dlp-io-v\d+\.\d+\.\d+$') {
|
||
throw "Package tag must use dlp-io-vMAJOR.MINOR.PATCH format: $tag"
|
||
}
|
||
$packageVersion = $tag.Substring("dlp-io-v".Length)
|
||
|
||
$token = $env:ACTION_CLONE_TOKEN
|
||
if ([string]::IsNullOrWhiteSpace($token)) {
|
||
throw "GITHUB_TOKEN is required to clone the repository"
|
||
}
|
||
$server = [Uri]$env:ACTION_SERVER_URL
|
||
$clone = "$($server.Scheme)://x-access-token:$token@$($server.Authority)/$($env:ACTION_REPOSITORY).git"
|
||
$masked = [regex]::Escape($token)
|
||
$tagRef = "refs/tags/$tag"
|
||
$peeledRef = "$tagRef^{}"
|
||
$remoteOutput = @(git ls-remote --tags $clone $tagRef $peeledRef 2>&1)
|
||
$remoteExit = $LASTEXITCODE
|
||
$remoteOutput | ForEach-Object { $_ -replace $masked, "***" }
|
||
if ($remoteExit -ne 0) { throw "remote tag lookup failed: $remoteExit" }
|
||
$remoteRefs = @{}
|
||
foreach ($line in $remoteOutput) {
|
||
if ($line -match '^([0-9a-f]{40})\s+(.+)$') {
|
||
$remoteRefs[$Matches[2]] = $Matches[1]
|
||
}
|
||
}
|
||
if (-not $remoteRefs.ContainsKey($tagRef)) {
|
||
throw "Remote package tag does not exist: $tagRef"
|
||
}
|
||
if (-not $remoteRefs.ContainsKey($peeledRef)) {
|
||
throw "Package tag must be annotated: $tagRef"
|
||
}
|
||
$remoteCommit = $remoteRefs[$peeledRef]
|
||
|
||
git clone -c core.autocrlf=true --depth 1 --branch $tag $clone repo 2>&1 |
|
||
ForEach-Object { $_ -replace $masked, "***" }
|
||
if ($LASTEXITCODE -ne 0) { throw "tagged source clone failed: $LASTEXITCODE" }
|
||
|
||
Push-Location repo
|
||
try {
|
||
$sourceVersion = (& py -3.13 -c "import dlp_io; print(dlp_io.__version__)").Trim()
|
||
} finally {
|
||
Pop-Location
|
||
}
|
||
if ($sourceVersion -ne $packageVersion) {
|
||
throw "dlp-io tag/version mismatch: tag=$tag package=$sourceVersion"
|
||
}
|
||
$tagCommit = (git -C repo rev-list -n 1 $tag).Trim()
|
||
$headCommit = (git -C repo rev-parse HEAD).Trim()
|
||
if ($tagCommit -ne $remoteCommit -or $remoteCommit -ne $headCommit) {
|
||
throw "Immutable tag checkout mismatch: remote=$remoteCommit local=$tagCommit HEAD=$headCommit"
|
||
}
|
||
"DLP_IO_PACKAGE_TAG=$tag" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
|
||
"DLP_IO_PACKAGE_VERSION=$packageVersion" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
|
||
Write-Host "package source: $tag @ $headCommit"
|
||
|
||
- name: Test Python 3.10-3.14
|
||
shell: pwsh
|
||
run: |
|
||
$ErrorActionPreference = "Stop"
|
||
foreach ($pythonVersion in @("3.10", "3.11", "3.12", "3.13", "3.14")) {
|
||
& py "-$pythonVersion" --version
|
||
if ($LASTEXITCODE -ne 0) { throw "Python $pythonVersion is required" }
|
||
& py "-$pythonVersion" -m pip install -r requirements-dev.txt --progress-bar off
|
||
if ($LASTEXITCODE -ne 0) { throw "test dependency install failed on $pythonVersion" }
|
||
$abi = $pythonVersion.Replace(".", "")
|
||
$baseTemp = Join-Path $env:TEMP "dlp-io-py$abi-$PID"
|
||
& py "-$pythonVersion" -m pytest -q --basetemp $baseTemp
|
||
if ($LASTEXITCODE -ne 0) { throw "full pytest failed on $pythonVersion" }
|
||
}
|
||
|
||
- name: Build and check distribution
|
||
shell: pwsh
|
||
run: |
|
||
$ErrorActionPreference = "Stop"
|
||
py -3.13 -m pip install build twine --progress-bar off
|
||
if ($LASTEXITCODE -ne 0) { throw "build dependency install failed" }
|
||
py -3.13 -m build
|
||
if ($LASTEXITCODE -ne 0) { throw "dlp-io build failed" }
|
||
|
||
$version = $env:DLP_IO_PACKAGE_VERSION
|
||
$expected = @(
|
||
"dlp_io-$version-py3-none-any.whl",
|
||
"dlp_io-$version.tar.gz"
|
||
)
|
||
foreach ($pythonVersion in @("3.10", "3.11", "3.12", "3.13", "3.14")) {
|
||
$abi = $pythonVersion.Replace(".", "")
|
||
$wheel = "dlp_io-$version-cp$abi-cp$abi-win_amd64.whl"
|
||
$env:DLP_IO_PYD = "1"
|
||
try {
|
||
& py "-$pythonVersion" -m build --wheel --no-isolation
|
||
if ($LASTEXITCODE -ne 0) { throw "pyd build failed on $pythonVersion" }
|
||
} finally {
|
||
Remove-Item Env:DLP_IO_PYD
|
||
}
|
||
if (-not (Test-Path -LiteralPath (Join-Path dist $wheel) -PathType Leaf)) {
|
||
throw "expected pyd wheel missing: $wheel"
|
||
}
|
||
$expected += $wheel
|
||
}
|
||
|
||
py -3.13 -m twine check "dist\dlp_io-$($env:DLP_IO_PACKAGE_VERSION)*"
|
||
if ($LASTEXITCODE -ne 0) { throw "twine check failed" }
|
||
$actual = @(Get-ChildItem -LiteralPath dist -File | ForEach-Object Name)
|
||
if (Compare-Object $expected $actual) {
|
||
throw "distribution file set mismatch: $($actual -join ', ')"
|
||
}
|
||
|
||
$assetsDir = (New-Item -ItemType Directory -Force assets).FullName
|
||
Copy-Item -LiteralPath (Resolve-Path dlp_io.py) -Destination $assetsDir
|
||
Add-Type -AssemblyName System.IO.Compression.FileSystem
|
||
foreach ($wheelFile in @(Get-ChildItem -LiteralPath dist -Filter "*-cp3*-win_amd64.whl" -File)) {
|
||
$zip = [System.IO.Compression.ZipFile]::OpenRead($wheelFile.FullName)
|
||
try {
|
||
$pydEntries = @($zip.Entries | Where-Object { $_.FullName -like "*.pyd" })
|
||
if ($pydEntries.Count -ne 1) {
|
||
throw "pyd wheel must contain exactly one .pyd: $($wheelFile.Name)"
|
||
}
|
||
$target = Join-Path $assetsDir $pydEntries[0].Name
|
||
[System.IO.Compression.ZipFileExtensions]::ExtractToFile($pydEntries[0], $target, $true)
|
||
} finally {
|
||
$zip.Dispose()
|
||
}
|
||
}
|
||
$bareAssets = @(Get-ChildItem -LiteralPath $assetsDir -File | ForEach-Object Name)
|
||
if ($bareAssets.Count -ne 6) {
|
||
throw "bare asset set mismatch: $($bareAssets -join ', ')"
|
||
}
|
||
|
||
- name: Smoke test release artifacts
|
||
shell: pwsh
|
||
run: |
|
||
$ErrorActionPreference = "Stop"
|
||
$root = Join-Path $env:TEMP ("dlp-io-wheel-smoke-" + $PID)
|
||
$rootFull = [IO.Path]::GetFullPath($root)
|
||
$tempFull = [IO.Path]::GetFullPath($env:TEMP).TrimEnd('\') + '\'
|
||
if (-not $rootFull.StartsWith($tempFull, [StringComparison]::OrdinalIgnoreCase)) {
|
||
throw "unsafe wheel smoke path: $rootFull"
|
||
}
|
||
try {
|
||
py -3.13 -m venv $rootFull
|
||
if ($LASTEXITCODE -ne 0) { throw "wheel smoke venv creation failed" }
|
||
$python = Join-Path $rootFull "Scripts\python.exe"
|
||
$pureWheel = (Resolve-Path (Join-Path dist "dlp_io-$($env:DLP_IO_PACKAGE_VERSION)-py3-none-any.whl")).Path
|
||
& $python -m pip install --no-index $pureWheel --progress-bar off
|
||
if ($LASTEXITCODE -ne 0) { throw "wheel installation failed" }
|
||
Push-Location $rootFull
|
||
try {
|
||
& $python -c "import dlp_io,sys,tempfile; from pathlib import Path; assert dlp_io.__version__ == '$env:DLP_IO_PACKAGE_VERSION'; td=tempfile.TemporaryDirectory(); p=Path(td.name)/'payload.bin'; w=dlp_io.open(p,'wb'); assert w.write(b'0123456789') == 10; w.close(); dlp_io.configure(python_executable=sys.executable); r=dlp_io.open(p,'rb'); assert r.read(4) == b'0123'; assert r.seek(-3,2) == 7; assert r.read() == b'789'; r.close(); dlp_io.shutdown(); td.cleanup(); print('wheel smoke passed')"
|
||
if ($LASTEXITCODE -ne 0) { throw "wheel smoke failed" }
|
||
} finally {
|
||
Pop-Location
|
||
}
|
||
} finally {
|
||
if (Test-Path -LiteralPath $rootFull) {
|
||
Remove-Item -LiteralPath $rootFull -Recurse -Force
|
||
}
|
||
}
|
||
|
||
foreach ($pythonVersion in @("3.10", "3.11", "3.12", "3.13", "3.14")) {
|
||
$abi = $pythonVersion.Replace(".", "")
|
||
$pydWheel = (Resolve-Path (Join-Path dist "dlp_io-$($env:DLP_IO_PACKAGE_VERSION)-cp$abi-cp$abi-win_amd64.whl")).Path
|
||
$pydRoot = Join-Path $env:TEMP ("dlp-io-pyd-smoke-$abi-" + $PID)
|
||
$pydRootFull = [IO.Path]::GetFullPath($pydRoot)
|
||
if (-not $pydRootFull.StartsWith($tempFull, [StringComparison]::OrdinalIgnoreCase)) {
|
||
throw "unsafe pyd smoke path: $pydRootFull"
|
||
}
|
||
try {
|
||
& py "-$pythonVersion" -m venv $pydRootFull
|
||
if ($LASTEXITCODE -ne 0) { throw "pyd smoke venv creation failed on $pythonVersion" }
|
||
$pydPython = Join-Path $pydRootFull "Scripts\python.exe"
|
||
& $pydPython -m pip install --no-index $pydWheel --progress-bar off
|
||
if ($LASTEXITCODE -ne 0) { throw "pyd wheel installation failed on $pythonVersion" }
|
||
Push-Location $pydRootFull
|
||
try {
|
||
& $pydPython -c "import dlp_io,sys,tempfile; from pathlib import Path; assert dlp_io.__version__ == '$env:DLP_IO_PACKAGE_VERSION'; td=tempfile.TemporaryDirectory(); p=Path(td.name)/'payload.bin'; w=dlp_io.open(p,'wb'); assert w.write(b'0123456789') == 10; w.close(); dlp_io.configure(python_executable=sys.executable); r=dlp_io.open(p,'rb'); assert r.read(4) == b'0123'; assert r.seek(-3,2) == 7; assert r.read() == b'789'; r.close(); dlp_io.shutdown(); td.cleanup(); print('pyd smoke passed on $pythonVersion')"
|
||
if ($LASTEXITCODE -ne 0) { throw "pyd wheel smoke failed on $pythonVersion" }
|
||
} finally {
|
||
Pop-Location
|
||
}
|
||
} finally {
|
||
if (Test-Path -LiteralPath $pydRootFull) {
|
||
Remove-Item -LiteralPath $pydRootFull -Recurse -Force
|
||
}
|
||
}
|
||
}
|
||
|
||
$bareRoot = Join-Path $env:TEMP ("dlp-io-bare-smoke-" + $PID)
|
||
$bareRootFull = [IO.Path]::GetFullPath($bareRoot)
|
||
if (-not $bareRootFull.StartsWith($tempFull, [StringComparison]::OrdinalIgnoreCase)) {
|
||
throw "unsafe bare smoke path: $bareRootFull"
|
||
}
|
||
try {
|
||
foreach ($pythonVersion in @("3.10", "3.11", "3.12", "3.13", "3.14")) {
|
||
$abi = $pythonVersion.Replace(".", "")
|
||
$sandbox = Join-Path $bareRootFull "cp$abi"
|
||
New-Item -ItemType Directory -Force $sandbox | Out-Null
|
||
Copy-Item -LiteralPath (Resolve-Path (Join-Path assets "dlp_io.cp$abi-win_amd64.pyd")) -Destination $sandbox
|
||
Push-Location $sandbox
|
||
try {
|
||
& py "-$pythonVersion" -c "import dlp_io,sys,tempfile; from pathlib import Path; assert dlp_io.__version__ == '$env:DLP_IO_PACKAGE_VERSION'; assert dlp_io.__file__.endswith('.pyd'); td=tempfile.TemporaryDirectory(); p=Path(td.name)/'payload.bin'; w=dlp_io.open(p,'wb'); assert w.write(b'0123456789') == 10; w.close(); dlp_io.configure(python_executable=sys.executable); r=dlp_io.open(p,'rb'); assert r.read(4) == b'0123'; assert r.seek(-3,2) == 7; assert r.read() == b'789'; r.close(); dlp_io.shutdown(); td.cleanup(); print('bare pyd smoke passed on $pythonVersion')"
|
||
if ($LASTEXITCODE -ne 0) { throw "bare pyd smoke failed on $pythonVersion" }
|
||
} finally {
|
||
Pop-Location
|
||
}
|
||
}
|
||
$pySandbox = Join-Path $bareRootFull "py"
|
||
New-Item -ItemType Directory -Force $pySandbox | Out-Null
|
||
Copy-Item -LiteralPath (Resolve-Path (Join-Path assets "dlp_io.py")) -Destination $pySandbox
|
||
Push-Location $pySandbox
|
||
try {
|
||
& py -3.13 -c "import dlp_io,sys,tempfile; from pathlib import Path; assert dlp_io.__version__ == '$env:DLP_IO_PACKAGE_VERSION'; assert dlp_io.__file__.endswith('.py'); td=tempfile.TemporaryDirectory(); p=Path(td.name)/'payload.bin'; w=dlp_io.open(p,'wb'); assert w.write(b'0123456789') == 10; w.close(); dlp_io.configure(python_executable=sys.executable); r=dlp_io.open(p,'rb'); assert r.read(4) == b'0123'; assert r.seek(-3,2) == 7; assert r.read() == b'789'; r.close(); dlp_io.shutdown(); td.cleanup(); print('bare py smoke passed')"
|
||
if ($LASTEXITCODE -ne 0) { throw "bare py smoke failed" }
|
||
} finally {
|
||
Pop-Location
|
||
}
|
||
} finally {
|
||
if (Test-Path -LiteralPath $bareRootFull) {
|
||
Remove-Item -LiteralPath $bareRootFull -Recurse -Force
|
||
}
|
||
}
|
||
|
||
- name: Create Gitea release with wheels
|
||
shell: pwsh
|
||
env:
|
||
GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||
GITEA_SERVER: ${{ gitea.server_url }}
|
||
GITEA_REPOSITORY: ${{ github.repository }}
|
||
run: |
|
||
$ErrorActionPreference = "Stop"
|
||
if ([string]::IsNullOrWhiteSpace($env:GITEA_TOKEN)) {
|
||
throw "GITHUB_TOKEN is required to publish the release"
|
||
}
|
||
$tag = $env:DLP_IO_PACKAGE_TAG
|
||
$version = $env:DLP_IO_PACKAGE_VERSION
|
||
$api = "$env:GITEA_SERVER/api/v1/repos/$env:GITEA_REPOSITORY"
|
||
$headers = @{ Authorization = "token $env:GITEA_TOKEN" }
|
||
|
||
$artifacts = @(Get-ChildItem -LiteralPath dist -File) + @(Get-ChildItem -LiteralPath assets -File)
|
||
if ($artifacts.Count -eq 0) { throw "no distribution files to publish" }
|
||
|
||
$release = $null
|
||
try {
|
||
$release = Invoke-RestMethod -Headers $headers -Uri "$api/releases/tags/$tag"
|
||
} catch {
|
||
if ([int]$_.Exception.Response.StatusCode -ne 404) { throw }
|
||
}
|
||
if ($null -eq $release) {
|
||
$notes = @(
|
||
"dlp-io $version",
|
||
"",
|
||
"## 产物",
|
||
"",
|
||
"- ``dlp_io-$version-py3-none-any.whl``：纯 Python wheel，pip 安装，跨平台",
|
||
"- ``dlp_io-$version-cp3XX-cp3XX-win_amd64.whl``：pyd wheel，pip 安装，Windows 按解释器版本选用（cp310-cp314）",
|
||
"- ``dlp_io-$version.tar.gz``：sdist 源码包",
|
||
"- ``dlp_io.py`` / ``dlp_io.cp3XX-win_amd64.pyd``：免安装单文件，直接放进项目目录即可 ``import dlp_io``",
|
||
"",
|
||
"## 安装",
|
||
"",
|
||
"纯 Python wheel（跨平台）：",
|
||
"",
|
||
"``````",
|
||
"py -m pip install $env:GITEA_SERVER/$env:GITEA_REPOSITORY/releases/download/$tag/dlp_io-$version-py3-none-any.whl",
|
||
"``````",
|
||
"",
|
||
"pyd wheel（Windows，示例为 CPython 3.13，其它版本替换文件名中的 cp313）：",
|
||
"",
|
||
"``````",
|
||
"py -3.13 -m pip install $env:GITEA_SERVER/$env:GITEA_REPOSITORY/releases/download/$tag/dlp_io-$version-cp313-cp313-win_amd64.whl",
|
||
"``````"
|
||
) -join "`n"
|
||
$body = @{
|
||
tag_name = $tag
|
||
name = "dlp-io $version"
|
||
body = $notes
|
||
draft = $false
|
||
prerelease = $false
|
||
} | ConvertTo-Json
|
||
$release = Invoke-RestMethod -Method Post -Headers $headers -Uri "$api/releases" -Body $body -ContentType "application/json"
|
||
Write-Host "created release: $tag"
|
||
} else {
|
||
Write-Host "release already exists: $tag"
|
||
}
|
||
|
||
foreach ($artifact in $artifacts) {
|
||
$existing = @($release.assets | Where-Object name -eq $artifact.Name)
|
||
if ($existing.Count -gt 0) {
|
||
Write-Host "asset already exists, skipping: $($artifact.Name)"
|
||
continue
|
||
}
|
||
Invoke-RestMethod -Method Post -Headers $headers -Uri "$api/releases/$($release.id)/assets?name=$($artifact.Name)" -Form @{ attachment = Get-Item $artifact.FullName } | Out-Null
|
||
Write-Host "uploaded asset: $($artifact.Name)"
|
||
}
|
||
|
||
$published = Invoke-RestMethod -Headers $headers -Uri "$api/releases/$($release.id)"
|
||
$publishedNames = @($published.assets | ForEach-Object name)
|
||
$localNames = @($artifacts | ForEach-Object Name)
|
||
if (Compare-Object $localNames $publishedNames) {
|
||
throw "release asset mismatch: $($publishedNames -join ', ')"
|
||
}
|
||
Write-Host "release verified: $tag ($($localNames.Count) files)"
|
||
|
||
- name: Publish packages to Gitea PyPI
|
||
shell: pwsh
|
||
env:
|
||
TWINE_USERNAME: antior
|
||
TWINE_PASSWORD: ${{ secrets.CI_PACKAGE_TOKEN }}
|
||
TWINE_REPOSITORY_URL: ${{ gitea.server_url }}/api/packages/antior/pypi
|
||
run: |
|
||
$ErrorActionPreference = "Stop"
|
||
if ([string]::IsNullOrWhiteSpace($env:TWINE_PASSWORD)) {
|
||
throw "CI_PACKAGE_TOKEN repository secret (PAT with write:package) is required"
|
||
}
|
||
$headers = @{ Authorization = "token $env:TWINE_PASSWORD" }
|
||
$simpleUrl = "$env:TWINE_REPOSITORY_URL/simple/dlp-io/"
|
||
|
||
function Get-RegistryFileNames {
|
||
try {
|
||
$response = Invoke-WebRequest -Headers $headers -Uri $simpleUrl
|
||
} catch {
|
||
if ([int]$_.Exception.Response.StatusCode -eq 404) { return @() }
|
||
throw
|
||
}
|
||
return @([regex]::Matches($response.Content, '<a\s+href="[^"]+"[^>]*>(?<name>[^<]+)</a>', "IgnoreCase") |
|
||
ForEach-Object { [Net.WebUtility]::HtmlDecode($_.Groups["name"].Value) })
|
||
}
|
||
|
||
$published = @(Get-RegistryFileNames)
|
||
$missing = @(Get-ChildItem -LiteralPath dist -File | Where-Object { $published -notcontains $_.Name })
|
||
if ($missing.Count -gt 0) {
|
||
$uploadArgs = @("-3.13", "-m", "twine", "upload", "--non-interactive", "--disable-progress-bar") +
|
||
@($missing | ForEach-Object FullName)
|
||
& py @uploadArgs
|
||
if ($LASTEXITCODE -ne 0) { throw "twine upload failed" }
|
||
} else {
|
||
Write-Host "all registry artifacts already published"
|
||
}
|
||
|
||
$expected = @(Get-ChildItem -LiteralPath dist -File | ForEach-Object Name)
|
||
for ($attempt = 1; $attempt -le 20; $attempt++) {
|
||
$published = @(Get-RegistryFileNames)
|
||
$unpublished = @($expected | Where-Object { $published -notcontains $_ })
|
||
if ($unpublished.Count -eq 0) { break }
|
||
if ($attempt -lt 20) { Start-Sleep -Seconds 3 }
|
||
}
|
||
if ($unpublished.Count -ne 0) {
|
||
throw "registry package files missing after upload: $($unpublished -join ', ')"
|
||
}
|
||
Write-Host "registry verified: dlp-io==$($env:DLP_IO_PACKAGE_VERSION) ($($expected.Count) files)"
|