publish.yml

name: Labelbox Python SDK Publish

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release Tag'
        required: true
      prev_sdk_tag:
        description: 'Prev SDK Release Tag, used to determine which lbox files have changed'
        required: true
      skip-tests:
        description: 'Skip PROD Test (Do not do this unless there is an emergency)'
        default: false
        type: boolean


concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
permissions:
  contents: read
  pages: write
  id-token: write

jobs:
  # Immutable releases reject asset uploads once a release is published, so the
  # release must be a draft while this workflow attaches assets. It is published
  # by the publish-release job at the end.
  check-draft-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write # needed to read draft releases
    steps:
      - name: Check that the release is a draft
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          TAG: ${{ inputs.tag }}
        run: |
          if ! is_draft=$(gh release view "$TAG" --json isDraft --jq .isDraft); then
            echo "::error::No release found for $TAG. Create it as a draft (do not publish it), then rerun."
            exit 1
          fi
          if [ "$is_draft" != "true" ]; then
            echo "::error::Release $TAG is already published. Assets can only be added to a draft release."
            exit 1
          fi
#  build-lbox:
#    permissions:
#      actions: read
#      contents: write
#      id-token: write # Needed to access the workflow's OIDC identity.
#      packages: write
#    uses: ./.github/workflows/lbox-publish.yml
#    with:
#      tag: ${{ inputs.tag }}
#      prev_sdk_tag: ${{ inputs.prev_sdk_tag }}
#    secrets: inherit
  build:
#    needs: ['build-lbox']
    needs: ['check-draft-release']
    runs-on: ubuntu-latest
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.tag }}
      - name: Install the latest version of rye
        uses: eifinger/setup-rye@787604a465b1696ad17eedf2f8101df9fc555c94 # v2
        with:
          version: ${{ vars.RYE_VERSION }}
          enable-cache: true
      - name: Rye Setup
        run: |
           rye config --set-bool behavior.use-uv=true
      - name: Create build
        working-directory: libs/labelbox
        run: |
          rye sync
          rye build
      - name: "Generate hashes"
        id: hash
        run: |
          cd dist && echo "hashes=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: build
          path: ./dist
  # The SLSA generators must be referenced by tag, not SHA: they use the tag to
  # fetch and verify their builder, and slsa-verifier checks it.
  provenance_python:
    needs: [build]
    permissions:
      actions: read
      contents: write # Required even with upload-assets: false, see slsa-framework/slsa-github-generator#2044
      id-token: write # Needed to access the workflow's OIDC identity.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      provenance-name: multiple.intoto.jsonl
      upload-assets: false # Uploaded to the draft release by publish-python-package-to-release
  attest_python:
    needs: [build]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # Needed to access the workflow's OIDC identity.
      attestations: write
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: build
          path: ./dist
      - name: Attest build provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: dist/*
  test-build:
    if: ${{ !inputs.skip-tests }}
    needs: ['build']
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - python-version: "3.9"
            prod-key: PROD_LABELBOX_API_KEY_3
            da-test-key: DA_GCP_LABELBOX_API_KEY
          - python-version: "3.10"
            prod-key: PROD_LABELBOX_API_KEY_4
            da-test-key: DA_GCP_LABELBOX_API_KEY
          - python-version: "3.11"
            prod-key: LABELBOX_API_KEY
            da-test-key: DA_GCP_LABELBOX_API_KEY
          - python-version: "3.12"
            prod-key: PROD_LABELBOX_API_KEY_5
            da-test-key: DA_GCP_LABELBOX_API_KEY
          - python-version: "3.13"
            prod-key: PROD_LABELBOX_API_KEY_2
            da-test-key: DA_GCP_LABELBOX_API_KEY            
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.tag }}
      - name: Install the latest version of rye
        uses: eifinger/setup-rye@787604a465b1696ad17eedf2f8101df9fc555c94 # v2
        with:
          version: ${{ vars.RYE_VERSION }}
          enable-cache: true
      - name: Rye Setup
        run: |
           rye config --set-bool behavior.use-uv=true
      - name: Python setup
        run: rye pin ${{ matrix.python-version }}
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: build
          path: ./dist
      - name: Prepare package and environment
        run: |
          rye sync -f --update-all
          rye run toml unset --toml-path pyproject.toml tool.rye.workspace
          rye sync -f --update-all
      - name: Integration Testing
        env:
          PYTEST_XDIST_AUTO_NUM_WORKERS: 32
          LABELBOX_TEST_API_KEY: ${{ secrets[matrix.prod-key] }}
          DA_GCP_LABELBOX_API_KEY: ${{ secrets[matrix.da-test-key] }}
          LABELBOX_TEST_ENVIRON: prod
        run: |
          rye add labelbox --path ./$(find ./dist/ -name *.tar.gz) --sync --absolute
          cd libs/labelbox
          rm pyproject.toml
          rye run pytest tests/integration
      - name: Data Testing
        env:
          PYTEST_XDIST_AUTO_NUM_WORKERS: 32
          LABELBOX_TEST_API_KEY: ${{ secrets[matrix.prod-key] }}
          DA_GCP_LABELBOX_API_KEY: ${{ secrets[matrix.da-test-key] }}
          LABELBOX_TEST_ENVIRON: prod
        run: |
          rye add labelbox --path ./$(find ./dist/ -name *.tar.gz) --sync --absolute --features data
          cd libs/labelbox
          rye run pytest tests/data
  publish-python-package-to-release:
    runs-on: ubuntu-latest
    # Upload only after tests pass, so a failed test run leaves the draft empty.
    needs: ['build', 'provenance_python', 'test-build']
    if: |
      always() &&
      needs.build.result == 'success' &&
      needs.provenance_python.result == 'success' &&
      (needs.test-build.result == 'success' || needs.test-build.result == 'skipped')
    permissions:
      contents: write    
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.tag }}
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: build
          path: ./artifact
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: multiple.intoto.jsonl
          path: ./artifact
      # --clobber lets "Re-run failed jobs" retry a partial upload. The release
      # is still a draft here (check-draft-release), so nothing public changes.
      - name: Upload dist to release
        run: |
          gh release upload "$TAG" ./artifact/* --clobber
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ inputs.tag }}
  pypi-publish:   
    runs-on: ubuntu-latest
    needs: ['build', 'test-build']
    # build must be checked too: when it is skipped or fails, test-build is
    # skipped as well, which would otherwise let this job run.
    if: |
      always() &&
      needs.build.result == 'success' &&
      (needs.test-build.result == 'success' || needs.test-build.result == 'skipped') && github.event.inputs.tag
    environment: 
      name: publish
      url: 'https://pypi.org/project/labelbox/'
    permissions:
      # IMPORTANT: this permission is mandatory for trusted publishing
      id-token: write
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: build
          path: ./artifact
      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
        with:
          packages-dir: artifact/
  publish-release:
    runs-on: ubuntu-latest
    needs: ['publish-python-package-to-release', 'attest_python', 'pypi-publish']
    # always() is needed because pypi-publish can follow a skipped test-build.
    if: |
      always() &&
      needs.publish-python-package-to-release.result == 'success' &&
      needs.attest_python.result == 'success' &&
      needs.pypi-publish.result == 'success'
    permissions:
      contents: write
    steps:
      - name: Publish release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          TAG: ${{ inputs.tag }}
        run: |
          gh release edit "$TAG" --draft=false --verify-tag
  container-publish:
    runs-on: ubuntu-latest
    needs: ['build', 'test-build']
    permissions:
      packages: write
    outputs:
      image: ${{ steps.image.outputs.image }}
      digest: ${{ steps.build_container.outputs.digest }}
    # build must be checked too: when it is skipped or fails, test-build is
    # skipped as well, which would otherwise let this job run.
    if: |
      always() &&
      needs.build.result == 'success' &&
      (needs.test-build.result == 'success' || needs.test-build.result == 'skipped') && github.event.inputs.tag
    env:
      CONTAINER_IMAGE: "ghcr.io/${{ github.repository }}"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ inputs.tag }}

      - name: downcase CONTAINER_IMAGE
        run: |
          echo "CONTAINER_IMAGE=${CONTAINER_IMAGE,,}" >> ${GITHUB_ENV}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
  
      - name: Log in to the Container registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
  
      - name: Build and push
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
        id: build_container
        with:
          context: .
          file: ./libs/labelbox/Dockerfile
          github-token: ${{ secrets.GITHUB_TOKEN }}
          push: true
  
          platforms: |
            linux/amd64
            linux/arm64
  
          tags: |
            ${{ env.CONTAINER_IMAGE }}:latest
            ${{ env.CONTAINER_IMAGE }}:${{ inputs.tag }}
      - name: Output image
        id: image
        run: |
          # NOTE: Set the image as an output because the `env` context is not
          # available to the inputs of a reusable workflow call.
          image_name="${CONTAINER_IMAGE}"
          echo "image=$image_name" >> "$GITHUB_OUTPUT"

  provenance_container:
    needs: [container-publish]
    # always() is needed because container-publish can follow a skipped test-build.
    if: always() && needs.container-publish.result == 'success'
    permissions:
      actions: read # for detecting the Github Actions environment.
      id-token: write # for creating OIDC tokens for signing.
      packages: write # for uploading attestations.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ${{ needs. container-publish.outputs.image }}
      digest: ${{ needs. container-publish.outputs.digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}