Release #29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| package: | |
| description: 'Library to release' | |
| required: true | |
| type: choice | |
| options: | |
| - giskard-core | |
| - giskard-llm | |
| - giskard-agents | |
| - giskard-checks | |
| bump_type: | |
| description: 'Version bump type' | |
| required: true | |
| type: choice | |
| options: | |
| - major | |
| - minor | |
| - patch | |
| - none | |
| default: patch | |
| release_type: | |
| description: 'Release type' | |
| required: true | |
| type: choice | |
| options: | |
| - alpha | |
| - beta | |
| - rc | |
| - none | |
| default: none | |
| dry_run: | |
| description: 'If true, the release will not be published to PyPI' | |
| required: false | |
| type: boolean | |
| default: true | |
| permissions: {} | |
| concurrency: | |
| group: release-${{ github.event.inputs.package }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| name: release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # push commits, tags, and create releases | |
| id-token: write # PyPI trusted publishing (OIDC) | |
| environment: release | |
| env: | |
| PACKAGE: ${{ github.event.inputs.package }} | |
| BUMP_TYPE: ${{ github.event.inputs.bump_type }} | |
| RELEASE_TYPE: ${{ github.event.inputs.release_type }} | |
| steps: | |
| - name: Authorize | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| ACTOR: ${{ github.actor }} | |
| run: | | |
| if ! gh api "orgs/Giskard-AI/members/$ACTOR" --silent 2>/dev/null; then | |
| echo "::error::Only Giskard-AI organization members can create releases." | |
| exit 1 | |
| fi | |
| - name: Generate app token | |
| id: app-token | |
| uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3 | |
| with: | |
| app-id: ${{ vars.RELEASE_APP_ID }} | |
| private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| persist-credentials: false | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 | |
| with: | |
| enable-cache: false | |
| python-version: "3.12" | |
| - name: Setup development environment | |
| run: make setup | |
| - name: Run checks | |
| run: make check | |
| # OpenAI credentials; TEST_PROVIDER=openai makes libs/giskard-llm/tests/conftest.py | |
| # skip non-OpenAI provider tests (bare is included via groups). Full `make test` still | |
| # runs other workspace packages鈥攐nly giskard-llm reads TEST_PROVIDER for now. | |
| - name: Install OpenAI extras for functional tests | |
| run: | | |
| uv pip install "giskard-llm[openai]" | |
| uv pip install "giskard-agents[openai]" | |
| - name: Run tests | |
| env: | |
| OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} | |
| TEST_MODEL: "openai/gpt-4.1-nano" | |
| TEST_PROVIDER: openai | |
| TEST_LITELLM_MODEL: "openai/gpt-4.1-nano" | |
| TEST_EMBEDDING_MODEL: "openai/text-embedding-3-small" | |
| run: | | |
| make test | |
| - name: Bump version | |
| id: bump | |
| working-directory: libs/${{ env.PACKAGE }} | |
| run: | | |
| CMD=("uv" "version") | |
| if [ "$BUMP_TYPE" != "none" ]; then | |
| CMD+=("--bump" "$BUMP_TYPE") | |
| fi | |
| if [ "$RELEASE_TYPE" != "none" ] && [ -n "$RELEASE_TYPE" ]; then | |
| CMD+=("--bump" "$RELEASE_TYPE") | |
| fi | |
| if [ ${#CMD[@]} -gt 2 ]; then | |
| "${CMD[@]}" | |
| else | |
| echo "No version bump" | |
| exit 1 | |
| fi | |
| NEW_VERSION=$(uv version --short) | |
| echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT | |
| echo "tag=$PACKAGE/v$NEW_VERSION" >> $GITHUB_OUTPUT | |
| - name: Update lockfile | |
| run: uv lock | |
| - name: Build package | |
| working-directory: libs/${{ env.PACKAGE }} | |
| run: | | |
| uv build --out-dir dist | |
| - name: Commit version bump | |
| env: | |
| NEW_VERSION: ${{ steps.bump.outputs.new_version }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add "libs/${PACKAGE}/pyproject.toml" "uv.lock" | |
| git commit -m "chore($PACKAGE): bump version to $NEW_VERSION" | |
| - name: Push to main | |
| if: ${{ github.event.inputs.dry_run == 'false' && github.ref_name == 'main' }} | |
| env: | |
| APP_TOKEN: ${{ steps.app-token.outputs.token }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| git remote set-url origin "https://x-access-token:${APP_TOKEN}@github.com/${REPO}.git" | |
| git push origin main | |
| - name: Create tag | |
| if: ${{ github.event.inputs.dry_run == 'false' }} | |
| env: | |
| APP_TOKEN: ${{ steps.app-token.outputs.token }} | |
| REPO: ${{ github.repository }} | |
| TAG: ${{ steps.bump.outputs.tag }} | |
| run: | | |
| git remote set-url origin "https://x-access-token:${APP_TOKEN}@github.com/${REPO}.git" | |
| git tag "$TAG" | |
| git push origin "$TAG" | |
| - name: Create GitHub Release | |
| if: ${{ github.event.inputs.dry_run == 'false' }} | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TAG: ${{ steps.bump.outputs.tag }} | |
| NEW_VERSION: ${{ steps.bump.outputs.new_version }} | |
| run: | | |
| gh release create "$TAG" \ | |
| --title "$PACKAGE v$NEW_VERSION" \ | |
| --generate-notes \ | |
| libs/"$PACKAGE"/dist/*.tar.gz \ | |
| libs/"$PACKAGE"/dist/*.whl | |
| - name: Push to PyPI | |
| if: ${{ github.event.inputs.dry_run == 'false' }} | |
| working-directory: libs/${{ env.PACKAGE }} | |
| run: uv publish |