amplifier-agent/.github/workflows/publish-python.yml at main · microsoft/amplifier-agent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
name: Publish Python packages to PyPI

# Publishes two separate Python packages to PyPI via OIDC trusted publishing.
# No API token secrets required — auth is short-lived, exchanged at publish time.
#
# Tag conventions (PyPI publishing paths):
#   v<version>    — amplifier-agent engine (root pyproject.toml)
#   py-v<version> — amplifier-agent-py wrapper (wrappers/python-py/pyproject.toml)
#
# Note: existing tag namespaces continue to work alongside these:
#   wrapper-v*    → npm trusted publish of the TypeScript wrapper (publish-wrapper.yml)
#   v*/wrapper-v* → GitHub Release creation (release-notes.yml)
#
# Bootstrap: before the first release of each package, a PyPI pending trusted
# publisher must be configured for that package. See RELEASING.md for the
# one-time setup checklist.

on:
  push:
    tags:
      - 'v*'
      - 'py-v*'
  workflow_dispatch:

concurrency:
  group: publish-python-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # ─── Engine (amplifier-agent, root package) ─────────────────────────────────
  publish-engine:
    name: Publish amplifier-agent engine to PyPI
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
    # id-token:write is required for OIDC trusted publishing.
    # contents:read is required for actions/checkout.
    permissions:
      contents: read
      id-token: write
    environment: pypi

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1

      - name: Verify tag matches pyproject.toml version
        if: github.event_name != 'workflow_dispatch'
        run: |
          PKG_VERSION="$(python3 -c "import tomllib; data=tomllib.load(open('pyproject.toml','rb')); print(data['project']['version'])")"
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            echo "::error::Tag version ($TAG_VERSION) does not match pyproject.toml version ($PKG_VERSION)"
            exit 1
          fi
          echo "Publishing amplifier-agent@$PKG_VERSION"

      # Release gate: the wheel must ship protocol/spec.md, protocol/schemas/,
      # the conformance fixtures, and every bundle/**/*.md. A wheel missing any
      # of these installs and imports fine, then fails at runtime for every user
      # (silent skill/mode discovery gaps). The script builds its own wheel into
      # a temp dir, so it leaves dist/ untouched for the real build below.
      - name: Verify wheel contents (scripts/verify-wheel.py)
        run: ./scripts/verify-wheel.py

      - name: Build sdist and wheel
        run: uv build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  # ─── Python wrapper (amplifier-agent-py, wrappers/python-py/) ───────────────
  publish-wrapper:
    name: Publish amplifier-agent-py wrapper to PyPI
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: startsWith(github.ref, 'refs/tags/py-v')
    # id-token:write is required for OIDC trusted publishing.
    # contents:read is required for actions/checkout.
    permissions:
      contents: read
      id-token: write
    environment: pypi

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1

      - name: Verify tag matches wrappers/python-py pyproject.toml version
        run: |
          PKG_VERSION="$(python3 -c "import tomllib; data=tomllib.load(open('wrappers/python-py/pyproject.toml','rb')); print(data['project']['version'])")"
          TAG_VERSION="${GITHUB_REF_NAME#py-v}"
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            echo "::error::Tag version ($TAG_VERSION) does not match wrappers/python-py version ($PKG_VERSION)"
            exit 1
          fi
          echo "Publishing amplifier-agent-py@$PKG_VERSION"

      # Build from the wrapper subdirectory. Because wrappers/python-py is a
      # uv workspace member, uv places output in the workspace-root dist/ dir.
      - name: Build sdist and wheel
        run: uv build --directory wrappers/python-py

      # pypa/gh-action-pypi-publish defaults to dist/ — correct for this job
      # since only wrapper artifacts are present (fresh checkout, no engine build).
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1