python-sdk-release.yml

# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
#
# SPDX-License-Identifier: Apache-2.0

name: Publish Python SDK to PyPI
on:
  push:
    tags: ['python-sdk-v*']
  workflow_dispatch:
    inputs:
      target:
        description: 'Publish target'
        required: true
        default: 'pypi'
        type: choice
        options:
          - pypi
          - testpypi

permissions:
  id-token: write
  contents: write

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: '3.11'

      # Build with the pinned, hash-checked backend alone: pdm-backend has no
      # dependencies on Python >= 3.10, so nothing else is resolved in this
      # credentialed job.
      - name: Install build backend
        run: |
          echo 'pdm-backend==2.5.0 --hash=sha256:5b8746b567a16a1fd506ce66ee28e89d46374526f52238aa1b96cc2c08245c63' > "$RUNNER_TEMP/build-requirements.txt"
          pip install --require-hashes --no-deps -r "$RUNNER_TEMP/build-requirements.txt"

      - name: Build distribution
        working-directory: sdk/python
        run: python -c "from pdm.backend import build_sdist, build_wheel; build_sdist('dist'); build_wheel('dist')"

      - name: Parse and verify version
        id: version
        working-directory: sdk/python
        run: |
          PKG_VERSION=$(python -c "
          import re
          with open('pyproject.toml') as f:
              m = re.search(r'^version\s*=\s*\"([^\"]+)\"', f.read(), re.M)
              print(m.group(1) if m else '')
          ")
          if [ -z "$PKG_VERSION" ]; then
            echo "::error::failed to parse version from pyproject.toml"
            exit 1
          fi
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="$PKG_VERSION"
          else
            TAG_VERSION="${GITHUB_REF_NAME#python-sdk-v}"
            if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
              echo "::error::tag version ($TAG_VERSION) does not match pyproject.toml version ($PKG_VERSION)"
              exit 1
            fi
            VERSION="$TAG_VERSION"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Publish to PyPI
        if: github.event_name == 'push' || github.event.inputs.target == 'pypi'
        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
        with:
          packages-dir: sdk/python/dist

      - name: Publish to TestPyPI
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'testpypi'
        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
        with:
          repository-url: https://test.pypi.org/legacy/
          packages-dir: sdk/python/dist

      - name: GitHub Release
        if: github.event_name == 'push'
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          name: "Python SDK v${{ steps.version.outputs.version }}"
          body: |
            ## PyPI Package

            **Package**: `dstack-sdk ${{ steps.version.outputs.version }}`

            **Install**: `pip install dstack-sdk==${{ steps.version.outputs.version }}`

            **Registry**: https://pypi.org/project/dstack-sdk/${{ steps.version.outputs.version }}/