picard/.github/workflows/pypi-release.yml

name: Package for PyPI

on: [push]

jobs:
  pypi-sdist:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v2
    - uses: actions/setup-python@v1
      with:
        python-version: 3.8
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install --upgrade -r requirements.txt
    - name: Run tests
      run: |
        python setup.py test
    - name: Build Python source distribution
      run: |
        python setup.py clean sdist
    - name: Upload artifacts
      uses: actions/upload-artifact@v2
      with:
        name: picard-sdist
        path: dist/*
    - name: Prepare GPG signing key
      run: |
        if [ -n "$CODESIGN_PGP_URL" ] && [ -n "$AWS_ACCESS_KEY_ID" ]; then
          pip3 install awscli
          aws s3 cp "$CODESIGN_PGP_URL" signkey.asc.enc
          openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 -in signkey.asc.enc -out signkey.asc -k "$CODESIGN_PGP_PASSWORD"
          gpg --import signkey.asc
          rm signkey.asc*
          echo "CODESIGN=1" >> $GITHUB_ENV
        else
          echo "::warning::No signing key available, skipping code signing."
        fi
      env:
        AWS_DEFAULT_REGION: eu-central-1
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        CODESIGN_PGP_URL: ${{ secrets.CODESIGN_PGP_URL }}
        CODESIGN_PGP_PASSWORD: ${{ secrets.CODESIGN_PGP_PASSWORD }}
    - name: Publish Python distribution to PyPI
      if: startsWith(github.ref, 'refs/tags/')
      run: |
        pip install --upgrade twine
        if [ "$CODESIGN" = '1' ]; then
          twine upload --non-interactive --sign --identity "$SIGN_IDENTITY" dist/*
        else
          twine upload --non-interactive dist/*
        fi
      env:
        TWINE_USERNAME: __token__
        TWINE_PASSWORD: ${{ secrets.PYPI_UPLOAD_TOKEN }}
        SIGN_IDENTITY: picard@metabrainz.org
    - name: Cleanup
      if: env.CODESIGN
      run: |
        rm -rf "$HOME/.gnupg"

  pypi-bdist:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [macos-10.15, windows-2019]
        python-version: [3.6, 3.7, 3.8, 3.9]

    steps:
    - uses: actions/checkout@v2
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v1
      with:
        python-version: ${{ matrix.python-version }}
    - name: Install gettext (macOS)
      if: runner.os == 'macOS'
      run: |
        brew install gettext
        brew link gettext --force
        echo "/usr/local/opt/gettext/bin" >> $GITHUB_PATH
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip wheel
        pip install --upgrade -r requirements.txt
    - name: Run tests
      run: |
        python setup.py test
    - name: Build Python binary distribution
      run: |
        python setup.py clean bdist_wheel
    - name: Upload artifacts
      uses: actions/upload-artifact@v2
      with:
        name: picard-bdist-${{ runner.os }}
        path: dist/*.whl
    - name: Publish Python distribution to PyPI
      if: startsWith(github.ref, 'refs/tags/')
      run: |
        pip install --upgrade twine>=3.0
        twine upload --non-interactive dist/*.whl
      env:
        TWINE_USERNAME: __token__
        TWINE_PASSWORD: ${{ secrets.PYPI_UPLOAD_TOKEN }}