.github/workflows/cd.yml - master - niceSOFT/python3-charset-normalizer

.github/workflows/cd.yml
236 строк8 KB
dependabot[bot]
chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#767)
07 июл 2026, 00:16
07 июл 2026, 00:16be252d7
name: Continuous Delivery

on:
  release:
    types:
      - created

permissions:
  contents: read

jobs:
  pre_flight_check:
    name: Preflight Checks
    uses: ./.github/workflows/ci.yml

  universal-wheel:
    name: Build Universal Wheel
    runs-on: ubuntu-latest
    needs:
      - pre_flight_check
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: '3'
      - name: Install CI Requirements
        run: |
          python -m pip install -r ci-requirements.txt --require-hashes
      - name: Build Wheel
        env:
          CHARSET_NORMALIZER_USE_MYPYC: '0'
        run: python -m build
      - name: Upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: dist-universal
          path: dist

  build-wheels:
    name: Build wheels on ${{ matrix.os }} ${{ matrix.qemu }}
    runs-on: ${{ matrix.os }}
    needs: pre_flight_check
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-14, windows-11-arm, ubuntu-24.04-arm]
        qemu: [ '' ]
        include:
          # Split ubuntu job for the sake of speed-up
          - os: ubuntu-latest
            qemu: ppc64le
          - os: ubuntu-latest
            qemu: riscv64
          - os: ubuntu-latest
            qemu: s390x
          - os: ubuntu-latest
            qemu: armv7l
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: true
          persist-credentials: false
      - name: Set up QEMU
        if: ${{ matrix.qemu }}
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
        with:
          platforms: all
        id: qemu
      - name: Prepare emulation
        if: ${{ matrix.qemu }}
        run: |
          echo "CIBW_ARCHS_LINUX=${{ matrix.qemu }}" >> $GITHUB_ENV
        shell: bash
      - name: Setup Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
      - name: Build wheels
        uses: pypa/cibuildwheel@294735312765b09d24a2fbec22660ce817587d55 # v4.1.0
        env:
          CIBW_BUILD_FRONTEND: build
          CIBW_ARCHS_MACOS: universal2
          CIBW_ENVIRONMENT: CHARSET_NORMALIZER_USE_MYPYC='1'
          # Drop the variants rather than freeze mypy < 2.0.
          # see https://github.com/mypyc/ast_serialize/pull/66
          CIBW_SKIP: "*-musllinux_riscv64 *-musllinux_ppc64le *-musllinux_s390x"
          CIBW_TEST_REQUIRES: pytest
          CIBW_TEST_COMMAND: pytest -c {package} {package}/tests
      - name: Upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: dist-${{ matrix.os }}-${{ matrix.qemu }}
          path: ./wheelhouse/*.whl

  checksum:
    name: Compute hashes
    runs-on: ubuntu-latest
    needs:
      - build-wheels
      - universal-wheel
    outputs:
      hashes: ${{ steps.compute.outputs.hashes }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Download distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          pattern: dist*
          merge-multiple: true
          path: dist
      - name: Collected dists
        run: |
          tree dist
      - name: Generate hashes
        id: compute  #  needs.checksum.outputs.hashes
        working-directory: ./dist
        run: echo "hashes=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT

  provenance:
    needs: checksum
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
    permissions:
      actions: read
      id-token: write
      contents: write
    with:
      base64-subjects: ${{ needs.checksum.outputs.hashes }}
      upload-assets: true
      compile-generator: true

  deploy:
    name: 🚀 Deploy to PyPi
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write
      contents: write
    needs:
      - provenance
    environment:
      name: pypi
      url: https://pypi.org/project/charset-normalizer/
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Download distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          pattern: dist*
          merge-multiple: true
          path: dist
      - name: Collected dists
        run: |
          tree dist
      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
      - name: Install Syft
        run: |
          curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin
          syft version
      - name: Generate SBOMs
        run: |
          set -euo pipefail
          shopt -s nullglob

          restore_from=""
          restore_to=""

          for pkg in dist/*.whl dist/*.tar.gz; do
            original_pkg="$pkg"
            original_base="$(basename -- "$original_pkg")"
            out="dist/${original_base}.cdx.json"

            if [[ "$original_pkg" == *.whl ]]; then
              zip_pkg="${original_pkg%.whl}.zip"
              zip_base="${original_base%.whl}.zip"
              stem="${original_base%.whl}"

              echo "Temporarily renaming ${original_base} -> ${zip_base}"
              mv -- "$original_pkg" "$zip_pkg"
              restore_from="$zip_pkg"
              restore_to="$original_pkg"

              echo "Generating SBOM for $original_base via $zip_base"
              syft "file:$zip_pkg" -o cyclonedx-json > "$out"

              tmp="$out.tmp"
              jq --arg stem "$stem" '
                (. | .. | objects | select(has("name")) | .name)
                |= (if . == ($stem + ".zip") then $stem + ".whl" else . end)
              ' "$out" > "$tmp" && mv "$tmp" "$out"

              echo "Restoring ${zip_base} -> ${original_base}"
              mv -- "$zip_pkg" "$original_pkg"
              restore_from=""
              restore_to=""
            else
              echo "Generating SBOM for $original_base"
              syft "file:$original_pkg" -o cyclonedx-json > "$out"
            fi
          done
      - name: Upload dists to GitHub Release
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          REF_NAME: "${{ github.ref_name }}"
          REPOSITORY: "${{ github.repository }}"
        run: |
          set -euo pipefail

          files=(dist/*)
          batch_size=50
          max_retries=3

          for (( i=0; i<${#files[@]}; i+=batch_size )); do
            batch=("${files[@]:i:batch_size}")
            echo "Uploading batch $((i/batch_size + 1)) (${#batch[@]} files)..."

            for (( attempt=1; attempt<=max_retries; attempt++ )); do
              if gh release upload "$REF_NAME" "${batch[@]}" --repo "$REPOSITORY" --clobber; then
                break
              fi

              if (( attempt == max_retries )); then
                echo "Failed to upload batch after $max_retries attempts"
                exit 1
              fi

              delay=$(( attempt * 15 ))
              echo "Upload failed (attempt $attempt/$max_retries). Retrying in ${delay}s..."
              sleep "$delay"
            done
          done