release.yml

# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# ---------------------------------------------------------------------------
# Release: build wheel, publish to PyPI (or Test PyPI on dry-run), and
# optionally create a GitHub release.
#
# Required repository secrets (Settings → Secrets and variables → Actions):
#   TEST_PYPI_PERSONAL_TOKEN  – API token scoped to nemo-anonymizer on Test PyPI
#   PYPI_PERSONAL_TOKEN       – API token scoped to nemo-anonymizer on PyPI
# ---------------------------------------------------------------------------

name: "Release NeMo Anonymizer"

on:
  workflow_dispatch:
    inputs:
      release-ref:
        description: Full SHA (not short) or tag of the commit to build
        required: true
        type: string
      dry-run:
        description: "Dry Run: only publish to Test PyPI"
        required: true
        default: true
        type: boolean
      create-gh-release:
        description: Create a GitHub release
        required: true
        default: true
        type: boolean

defaults:
  run:
    shell: bash -x -e -u -o pipefail {0}

permissions:
  contents: write

jobs:
  publish-wheel:
    name: Publish wheel (${{ inputs.dry-run && 'Test PyPI' || 'PyPI' }})
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.build.outputs.version }}
    steps:
      - name: Checkout at release ref
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.release-ref }}
          fetch-depth: 0
          fetch-tags: true

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version-file: ".python-version"

      - name: Build wheel
        id: build
        run: |
          make build-wheel
          WHEEL=$(ls dist/*.whl)
          VERSION=$(echo "$WHEEL" | sed -n 's/.*-\([0-9][^-]*\)-.*/\1/p')
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Built: $WHEEL (version $VERSION)"

      - uses: actions/upload-artifact@v7
        with:
          name: nemo-anonymizer-${{ steps.build.outputs.version }}
          path: dist/*.whl
          retention-days: 90

      - name: Publish to Test PyPI (always, as pre-flight)
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.TEST_PYPI_PERSONAL_TOKEN }}
        run: |
          uvx twine upload \
            --repository-url https://test.pypi.org/legacy/ \
            --skip-existing \
            --non-interactive \
            --verbose \
            dist/*.whl

      - name: Publish to PyPI
        if: ${{ !inputs.dry-run }}
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_PERSONAL_TOKEN }}
        run: |
          uvx twine upload \
            --non-interactive \
            --verbose \
            dist/*.whl

  create-gh-release:
    name: Create GitHub release
    needs: publish-wheel
    if: ${{ inputs.create-gh-release }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout at release ref
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.release-ref }}
          fetch-depth: 0

      - name: Download wheel artifact
        uses: actions/download-artifact@v8
        with:
          name: nemo-anonymizer-${{ needs.publish-wheel.outputs.version }}
          path: dist/

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.publish-wheel.outputs.version }}
        run: |
          PRERELEASE_FLAG=""
          if echo "$VERSION" | grep -qE '(^|[0-9])rc[0-9]+($|\+)'; then
            PRERELEASE_FLAG="--prerelease"
          fi

          gh release create "v${VERSION}" \
            dist/*.whl \
            --generate-notes \
            --title "v${VERSION}" \
            $PRERELEASE_FLAG

  deploy-release-docs:
    name: Deploy release docs
    needs: [publish-wheel, create-gh-release]
    if: ${{ inputs.create-gh-release }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout at release ref
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.release-ref }}
          fetch-depth: 0

      - uses: ./.github/actions/setup-python-env
        with:
          ref: ${{ inputs.release-ref }}
          fetch-depth: "0"

      - name: Install docs dependencies
        run: uv sync --group dev --group docs

      - name: Configure git for mike
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Build docs
        run: make docs-build

      - name: Deploy release docs with mike
        env:
          VERSION: ${{ needs.publish-wheel.outputs.version }}
        run: uv run --group docs mike deploy --push --update-aliases "$VERSION" latest