weblate/.github/workflows/setup.yml

# Copyright © Michal Čihař <michal@weblate.org>
#
# SPDX-License-Identifier: GPL-3.0-or-later

name: Distribution

on:
  push:
    branches-ignore:
    - renovate/**
    - weblate
    - dependabot/**
    tags:
    - weblate-*
  pull_request:

permissions:
  contents: read

jobs:
  dist:
    runs-on: ubuntu-24.04
    name: Build packages
    env:
      PYTHONUNBUFFERED: 1
      PYTHONWARNINGS: default,ignore:unclosed:ResourceWarning
    permissions:
      # Needed for Sigstore
      id-token: write
      # Needed for attestations
      attestations: write
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
    - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
      with:
        enable-cache: false
        version: 0.11.6
    - name: Setup Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        # Avoid 3.14 until https://github.com/sigstore/gh-action-sigstore-python/issues/215 is addressed
        python-version: '3.14'
    - name: build
      run: |
        echo "::add-matcher::.github/matchers/setuptools.json"
        uv build
        echo "::remove-matcher owner=setuptools::"
        rm -f dist/.gitignore
    - name: Sign the dists with Sigstore
      if: github.event_name == 'push'
      uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
      with:
        inputs: dist/*
    - name: Attest
      if: github.event_name == 'push'
      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
      with:
        subject-path: dist/*
    - uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
      if: github.event_name == 'push'
      with:
        subject-path: dist/*
        sbom-path: docs/specs/sbom/sbom.json
    - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        path: dist/*
        name: dist

  lint:
    runs-on: ubuntu-24.04
    name: Lint packages
    env:
      PYTHONUNBUFFERED: 1
    needs:
    - dist
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
    - name: Install apt dependencies
      run: sudo ./ci/apt-install
    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: '3.14'
    - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
      with:
        enable-cache: false
        version: 0.11.6
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: dist
        path: dist
    - name: Cleanup dist
      # Remove files not supported on PyPI (eg. Sigstore signatures)
      run: find dist -mindepth 1 -not -name '*.tar.gz' -not -name '*.whl' -delete
    - name: list wheel
      run: unzip -l dist/*.whl
    - name: list sdist
      run: tar tvf dist/*.tar.gz
    - name: twine check
      run: uvx twine check --strict dist/*
    - name: pydistcheck
      run: uvx pydistcheck --inspect dist/*
    - name: pyroma
      run: uvx --with pip pyroma dist/*.tar.gz
    - name: check-wheel-contents
      run: uvx check-wheel-contents dist/*.whl
    - name: check-manifest
      run: uvx --with pip check-manifest -v
    - name: install
      run: |
        uv venv .venv-install
        source .venv-install/bin/activate
        uv pip install dist/*.whl

  notes:
    runs-on: ubuntu-24.04
    name: Build release notes
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
    - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
      with:
        enable-cache: false
        version: 0.11.6
    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: '3.14'
    - name: Install apt dependencies
      run: |
        sudo apt update
        sudo apt install -y graphviz pandoc
    - name: Install Python dependencies
      run: uv sync --only-group docs --frozen
    - name: Sphinx build
      run: |
        . .venv/bin/activate
        ./ci/run-docs
    - name: Convert release notes
      run: |
        version=$(sed -n '/^VERSION =/ s/.*"\(.*\)"/\1/p' weblate/utils/version.py)
        namever="weblate-$version"
        sed "s/latest/$namever/" < scripts/release-notes-filter.lua > scripts/release-notes-filter.version.lua
        mkdir dist
        ./scripts/extract-release-notes.py > "dist/Weblate-$version.html"
        pandoc "dist/Weblate-$version.html" --write=gfm --wrap=none --lua-filter=scripts/release-notes-filter.version.lua -o "dist/Weblate-$version.md"
        rm scripts/release-notes-filter.version.lua
    - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        path: dist/*
        name: notes

  publish_pypi:
    name: Publish to PyPI
    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/weblate')
    permissions:
      # this permission is mandatory for trusted publishing
      id-token: write
    needs:
    - notes
    - dist
    - lint
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
    - name: Cleanup dist
      # Remove files not supported on PyPI (eg. Sigstore signatures)
      run: find dist -mindepth 1 -not -name '*.tar.gz' -not -name '*.whl' -delete
    - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
      with:
        enable-cache: false
        version: 0.11.6
    - run: uv publish --trusted-publishing always

  publish_github:
    name: Publish to GitHub
    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/weblate')
    permissions:
      # this permission is mandatory for creating a release
      contents: write
    needs:
    - notes
    - dist
    - lint
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
    - name: Extract notes body
      run: tail -n+3 notes/Weblate-*.md > notes.md
    - name: Extract notes title
      id: get-name
      run: echo "name=$(head -n1 notes/Weblate-*.md)"  > "$GITHUB_OUTPUT"
    - env:
        VERSION: ${{ github.ref_name }}
        GH_TOKEN: ${{ github.token }}
        TITLE: ${{ steps.get-name.outputs.name }}
      run: |
        gh release create "$VERSION" --verify-tag --title "$TITLE" --notes-file notes.md dist/*