Repository navigation
177 lines (168 loc) · 5.94 KB
/
Copy pathpublish.yml
File metadata and controls
177 lines (168 loc) · 5.94 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
name: Publish to PyPI
on:
release:
types:
- published
permissions: {}
concurrency:
group: pypi-${{ github.event.release.tag_name }}
cancel-in-progress: false
jobs:
checks:
permissions:
contents: read
pull-requests: read
runs-on: ubuntu-latest
steps:
# Tag rules and environment protection remain the release authorization boundary.
- name: Checkout release validator from main
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
ref: refs/heads/main
path: control
persist-credentials: false
sparse-checkout: .github/scripts
- name: Checkout release commit
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
ref: ${{ github.sha }}
path: release-source
fetch-depth: 0
persist-credentials: false
- name: Setup Python for release validation
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
with:
python-version: "3.14"
- name: Validate release provenance
env:
RELEASE_TAG: ${{ github.event.release.tag_name }}
RELEASE_SHA: ${{ github.sha }}
run: >-
python -I control/.github/scripts/verify_release.py
--repo release-source --tag "$RELEASE_TAG" --expected-sha "$RELEASE_SHA"
- name: Verify human-reviewed release candidate
if: vars.RELEASE_AUTOMATION_ENABLED == 'true'
env:
GH_TOKEN: ${{ github.token }}
RELEASE_SHA: ${{ github.sha }}
run: python -I control/.github/scripts/release_automation.py verify-publication
- name: Setup uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # setup-uv v9.0.0; uv 0.11.14
with:
version: "0.11.14"
enable-cache: false
python-version: "3.14"
- name: Check release source
working-directory: release-source
shell: bash
env:
OPENAI_API_KEY: fake-for-tests
UV_LOCKED: "1"
run: |
for python_version in 3.10 3.11 3.12 3.13 3.14; do
UV_PYTHON="$python_version" make sync tests
done
make typecheck
build:
# Test processes and filesystem mutations stay on the checks runner.
needs: checks
permissions:
contents: read
runs-on: ubuntu-latest
outputs:
artifact-id: ${{ steps.upload.outputs.artifact-id }}
steps:
# Tag rules and environment protection remain the release authorization boundary.
- name: Checkout release validator from main
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
ref: refs/heads/main
path: control
persist-credentials: false
sparse-checkout: .github/scripts
- name: Checkout release commit
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
ref: ${{ github.sha }}
path: release-source
fetch-depth: 0
persist-credentials: false
- name: Setup Python for release validation
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
with:
python-version: "3.14"
- name: Validate release provenance
env:
RELEASE_TAG: ${{ github.event.release.tag_name }}
RELEASE_SHA: ${{ github.sha }}
run: >-
python -I control/.github/scripts/verify_release.py
--repo release-source --tag "$RELEASE_TAG" --expected-sha "$RELEASE_SHA"
- name: Setup uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # setup-uv v9.0.0; uv 0.11.14
with:
version: "0.11.14"
enable-cache: false
python-version: "3.14"
- name: Build package
working-directory: release-source
run: uv build
- name: Store distributions
id: upload
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
with:
name: python-distributions-${{ github.run_attempt }}
path: release-source/dist/
if-no-files-found: error
retention-days: 7
publish:
needs: build
environment:
name: pypi
url: https://pypi.org/p/openai-agents
permissions:
id-token: write
contents: read
pull-requests: read
runs-on: ubuntu-latest
steps:
- name: Download distributions
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
with:
artifact-ids: ${{ needs.build.outputs.artifact-id }}
path: dist/
merge-multiple: true
- name: Checkout approval validator from main
if: vars.RELEASE_AUTOMATION_ENABLED == 'true'
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
ref: refs/heads/main
path: control
persist-credentials: false
sparse-checkout: .github/scripts
- name: Revalidate human approval before upload
if: vars.RELEASE_AUTOMATION_ENABLED == 'true'
env:
GH_TOKEN: ${{ github.token }}
RELEASE_SHA: ${{ github.sha }}
run: python3 -I control/.github/scripts/release_automation.py verify-publication
- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33
release-notes:
needs: checks
if: vars.RELEASE_AUTOMATION_ENABLED == 'true'
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
ref: refs/heads/main
persist-credentials: false
sparse-checkout: .github/scripts
- name: Append reviewed highlights and release assessment
env:
GH_TOKEN: ${{ github.token }}
RELEASE_SHA: ${{ github.sha }}
run: python -I .github/scripts/release_automation.py publish-notes