Skip to content

Commit a7b6938

Browse files
blink1073blink1073
authored
PYTHON-4388 [v4.8] Add SSDLC workflows (#1694)
1 parent ed7a586 commit a7b6938

File tree

4 files changed

+212
-134
lines changed

4 files changed

+212
-134
lines changed

‎.github/workflows/codeql.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@ on:
55
branches: [ "master", "v*"]
66
tags: ['*']
77
pull_request:
8+
workflow_call:
9+
inputs:
10+
ref:
11+
required: true
12+
type: string
813
schedule:
914
- cron: '17 10 * * 2'
1015

@@ -35,6 +40,8 @@ jobs:
3540
steps:
3641
- name: Checkout repository
3742
uses: actions/checkout@v4
43+
with:
44+
ref: ${{ inputs.ref }}
3845
- uses: actions/setup-python@v3
3946

4047
# Initializes the CodeQL tools for scanning.

‎.github/workflows/dist.yml‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
name: Python Dist
2+
3+
on:
4+
push:
5+
tags:
6+
- "[0-9]+.[0-9]+.[0-9]+"
7+
- "[0-9]+.[0-9]+.[0-9]+.post[0-9]+"
8+
- "[0-9]+.[0-9]+.[0-9]+[a-b][0-9]+"
9+
- "[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
10+
workflow_dispatch:
11+
pull_request:
12+
workflow_call:
13+
14+
concurrency:
15+
group: dist-${{ github.ref }}
16+
cancel-in-progress: true
17+
18+
defaults:
19+
run:
20+
shell: bash -eux {0}
21+
22+
jobs:
23+
build_wheels:
24+
name: Build wheels for ${{ matrix.buildplat[1] }}
25+
runs-on: ${{ matrix.buildplat[0] }}
26+
strategy:
27+
# Ensure that a wheel builder finishes even if another fails
28+
fail-fast: false
29+
matrix:
30+
# Github Actions doesn't support pairing matrix values together, let's improvise
31+
# https://github.com/github/feedback/discussions/7835#discussioncomment-1769026
32+
buildplat:
33+
- [ubuntu-20.04, "manylinux_x86_64", "cp3*-manylinux_x86_64"]
34+
- [ubuntu-20.04, "manylinux_aarch64", "cp3*-manylinux_aarch64"]
35+
- [ubuntu-20.04, "manylinux_ppc64le", "cp3*-manylinux_ppc64le"]
36+
- [ubuntu-20.04, "manylinux_s390x", "cp3*-manylinux_s390x"]
37+
- [ubuntu-20.04, "manylinux_i686", "cp3*-manylinux_i686"]
38+
- [windows-2019, "win_amd6", "cp3*-win_amd64"]
39+
- [windows-2019, "win32", "cp3*-win32"]
40+
- [macos-14, "macos", "cp*-macosx_*"]
41+
42+
steps:
43+
- name: Checkout pymongo
44+
uses: actions/checkout@v4
45+
with:
46+
fetch-depth: 0
47+
48+
- uses: actions/setup-python@v5
49+
with:
50+
cache: 'pip'
51+
python-version: 3.8
52+
cache-dependency-path: 'pyproject.toml'
53+
allow-prereleases: true
54+
55+
- name: Set up QEMU
56+
if: runner.os == 'Linux'
57+
uses: docker/setup-qemu-action@v3
58+
with:
59+
platforms: all
60+
61+
- name: Install cibuildwheel
62+
# Note: the default manylinux is manylinux2014
63+
run: |
64+
python -m pip install -U pip
65+
python -m pip install "cibuildwheel>=2.17,<3"
66+
67+
- name: Build wheels
68+
env:
69+
CIBW_BUILD: ${{ matrix.buildplat[2] }}
70+
run: python -m cibuildwheel --output-dir wheelhouse
71+
72+
- name: Build manylinux1 wheels
73+
if: ${{ matrix.buildplat[1] == 'manylinux_x86_64' || matrix.buildplat[1] == 'manylinux_i686' }}
74+
env:
75+
CIBW_MANYLINUX_X86_64_IMAGE: manylinux1
76+
CIBW_MANYLINUX_I686_IMAGE: manylinux1
77+
CIBW_BUILD: "cp38-${{ matrix.buildplat[1] }} cp39-${{ matrix.buildplat[1] }}"
78+
run: python -m cibuildwheel --output-dir wheelhouse
79+
80+
- name: Assert all versions in wheelhouse
81+
if: ${{ ! startsWith(matrix.buildplat[1], 'macos') }}
82+
run: |
83+
ls wheelhouse/*cp38*.whl
84+
ls wheelhouse/*cp39*.whl
85+
ls wheelhouse/*cp310*.whl
86+
ls wheelhouse/*cp311*.whl
87+
ls wheelhouse/*cp312*.whl
88+
89+
- uses: actions/upload-artifact@v4
90+
with:
91+
name: wheel-${{ matrix.buildplat[1] }}
92+
path: ./wheelhouse/*.whl
93+
if-no-files-found: error
94+
95+
make_sdist:
96+
name: Make SDist
97+
runs-on: macos-13
98+
steps:
99+
- uses: actions/checkout@v4
100+
with:
101+
fetch-depth: 0
102+
103+
- uses: actions/setup-python@v5
104+
with:
105+
# Build sdist on lowest supported Python
106+
python-version: '3.8'
107+
108+
- name: Build SDist
109+
run: |
110+
set -ex
111+
python -m pip install -U pip build
112+
python -m build --sdist .
113+
114+
- name: Test SDist
115+
run: |
116+
python -m pip install dist/*.gz
117+
cd ..
118+
python -c "from pymongo import has_c; assert has_c()"
119+
120+
- uses: actions/upload-artifact@v4
121+
with:
122+
name: "sdist"
123+
path: ./dist/*.tar.gz
124+
125+
collect_dist:
126+
runs-on: ubuntu-latest
127+
needs: [build_wheels, make_sdist]
128+
name: Download Wheels
129+
steps:
130+
- name: Download all workflow run artifacts
131+
uses: actions/download-artifact@v4
132+
- name: Flatten directory
133+
working-directory: .
134+
run: |
135+
find . -mindepth 2 -type f -exec mv {} . \;
136+
find . -type d -empty -delete
137+
- uses: actions/upload-artifact@v4
138+
with:
139+
name: all-dist-${{ github.run_id }}
140+
path: "./*"

‎.github/workflows/release-python.yml‎

Lines changed: 64 additions & 134 deletions
Original file line numberDiff line numberDiff line change
@@ -1,156 +1,86 @@
1-
name: Python Wheels
1+
name: Release
22

33
on:
4-
push:
5-
tags:
6-
- "[0-9]+.[0-9]+.[0-9]+"
7-
- "[0-9]+.[0-9]+.[0-9]+.post[0-9]+"
8-
- "[0-9]+.[0-9]+.[0-9]+[a-b][0-9]+"
9-
- "[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
104
workflow_dispatch:
11-
pull_request:
12-
13-
concurrency:
14-
group: wheels-${{ github.ref }}
15-
cancel-in-progress: true
5+
inputs:
6+
version:
7+
description: "The new version to set"
8+
required: true
9+
following_version:
10+
description: "The post (dev) version to set"
11+
required: true
12+
dry_run:
13+
description: "Dry Run?"
14+
default: false
15+
type: boolean
16+
17+
env:
18+
# Changes per repo
19+
PRODUCT_NAME: PyMongo
20+
# Changes per branch
21+
SILK_ASSET_GROUP: mongodb-python-driver
1622

1723
defaults:
1824
run:
1925
shell: bash -eux {0}
2026

2127
jobs:
22-
build_wheels:
23-
name: Build wheels for ${{ matrix.buildplat[1] }}
24-
runs-on: ${{ matrix.buildplat[0] }}
25-
strategy:
26-
# Ensure that a wheel builder finishes even if another fails
27-
fail-fast: false
28-
matrix:
29-
# Github Actions doesn't support pairing matrix values together, let's improvise
30-
# https://github.com/github/feedback/discussions/7835#discussioncomment-1769026
31-
buildplat:
32-
- [ubuntu-20.04, "manylinux_x86_64", "cp3*-manylinux_x86_64"]
33-
- [ubuntu-20.04, "manylinux_aarch64", "cp3*-manylinux_aarch64"]
34-
- [ubuntu-20.04, "manylinux_ppc64le", "cp3*-manylinux_ppc64le"]
35-
- [ubuntu-20.04, "manylinux_s390x", "cp3*-manylinux_s390x"]
36-
- [ubuntu-20.04, "manylinux_i686", "cp3*-manylinux_i686"]
37-
- [windows-2019, "win_amd6", "cp3*-win_amd64"]
38-
- [windows-2019, "win32", "cp3*-win32"]
39-
- [macos-14, "macos", "cp*-macosx_*"]
40-
28+
pre-publish:
29+
environment: release
30+
runs-on: ubuntu-latest
31+
permissions:
32+
id-token: write
33+
contents: write
4134
steps:
42-
- name: Checkout pymongo
43-
uses: actions/checkout@v4
44-
with:
45-
fetch-depth: 0
46-
47-
- uses: actions/setup-python@v5
48-
with:
49-
cache: 'pip'
50-
python-version: 3.8
51-
cache-dependency-path: 'pyproject.toml'
52-
allow-prereleases: true
53-
54-
- name: Set up QEMU
55-
if: runner.os == 'Linux'
56-
uses: docker/setup-qemu-action@v3
57-
with:
58-
platforms: all
59-
60-
- name: Install cibuildwheel
61-
# Note: the default manylinux is manylinux2014
62-
run: |
63-
python -m pip install -U pip
64-
python -m pip install "cibuildwheel>=2.17,<3"
65-
66-
- name: Build wheels
67-
env:
68-
CIBW_BUILD: ${{ matrix.buildplat[2] }}
69-
run: python -m cibuildwheel --output-dir wheelhouse
70-
71-
- name: Build manylinux1 wheels
72-
if: ${{ matrix.buildplat[1] == 'manylinux_x86_64' || matrix.buildplat[1] == 'manylinux_i686' }}
73-
env:
74-
CIBW_MANYLINUX_X86_64_IMAGE: manylinux1
75-
CIBW_MANYLINUX_I686_IMAGE: manylinux1
76-
CIBW_BUILD: "cp38-${{ matrix.buildplat[1] }} cp39-${{ matrix.buildplat[1] }}"
77-
run: python -m cibuildwheel --output-dir wheelhouse
78-
79-
- name: Assert all versions in wheelhouse
80-
if: ${{ ! startsWith(matrix.buildplat[1], 'macos') }}
81-
run: |
82-
ls wheelhouse/*cp38*.whl
83-
ls wheelhouse/*cp39*.whl
84-
ls wheelhouse/*cp310*.whl
85-
ls wheelhouse/*cp311*.whl
86-
ls wheelhouse/*cp312*.whl
87-
88-
- uses: actions/upload-artifact@v4
35+
- uses: mongodb-labs/drivers-github-tools/secure-checkout@v2
8936
with:
90-
name: wheel-${{ matrix.buildplat[1] }}
91-
path: ./wheelhouse/*.whl
92-
if-no-files-found: error
93-
94-
make_sdist:
95-
name: Make SDist
96-
runs-on: macos-13
97-
steps:
98-
- uses: actions/checkout@v4
37+
app_id: ${{ vars.APP_ID }}
38+
private_key: ${{ secrets.APP_PRIVATE_KEY }}
39+
- uses: mongodb-labs/drivers-github-tools/setup@v2
9940
with:
100-
fetch-depth: 0
101-
102-
- uses: actions/setup-python@v5
41+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
42+
aws_region_name: ${{ vars.AWS_REGION_NAME }}
43+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
44+
artifactory_username: ${{ vars.ARTIFACTORY_USERNAME }}
45+
- uses: mongodb-labs/drivers-github-tools/python/pre-publish@v2
10346
with:
104-
# Build sdist on lowest supported Python
105-
python-version: '3.8'
106-
107-
- name: Build SDist
108-
run: |
109-
set -ex
110-
python -m pip install -U pip build
111-
python -m build --sdist .
112-
113-
- name: Test SDist
114-
run: |
115-
python -m pip install dist/*.gz
116-
cd ..
117-
python -c "from pymongo import has_c; assert has_c()"
47+
version: ${{ inputs.version }}
48+
dry_run: ${{ inputs.dry_run }}
11849

119-
- uses: actions/upload-artifact@v4
120-
with:
121-
name: "sdist"
122-
path: ./dist/*.tar.gz
50+
build-dist:
51+
needs: [pre-publish]
52+
uses: ./.github/workflows/dist.yml
12353

124-
collect_dist:
125-
runs-on: ubuntu-latest
126-
needs: [build_wheels, make_sdist]
127-
name: Download Wheels
128-
steps:
129-
- name: Download all workflow run artifacts
130-
uses: actions/download-artifact@v4
131-
- name: Flatten directory
132-
working-directory: .
133-
run: |
134-
find . -mindepth 2 -type f -exec mv {} . \;
135-
find . -type d -empty -delete
136-
- uses: actions/upload-artifact@v4
137-
with:
138-
name: all-dist-${{ github.run_id }}
139-
path: "./*"
54+
static-scan:
55+
needs: [pre-publish]
56+
uses: ./.github/workflows/codeql.yml
57+
with:
58+
ref: ${{ inputs.version }}
14059

14160
publish:
142-
# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#publishing-the-distribution-to-pypi
143-
needs: [collect_dist]
144-
if: startsWith(github.ref, 'refs/tags/')
61+
needs: [build-dist, static-scan]
14562
runs-on: ubuntu-latest
14663
environment: release
14764
permissions:
14865
id-token: write
66+
contents: write
67+
security-events: write
14968
steps:
150-
- name: Download all the dists
151-
uses: actions/download-artifact@v4
152-
with:
153-
name: all-dist-${{ github.run_id }}
154-
path: dist/
155-
- name: Publish distribution 📦 to PyPI
156-
uses: pypa/gh-action-pypi-publish@release/v1
69+
- uses: mongodb-labs/drivers-github-tools/secure-checkout@v2
70+
with:
71+
app_id: ${{ vars.APP_ID }}
72+
private_key: ${{ secrets.APP_PRIVATE_KEY }}
73+
- uses: mongodb-labs/drivers-github-tools/setup@v2
74+
with:
75+
aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
76+
aws_region_name: ${{ vars.AWS_REGION_NAME }}
77+
aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
78+
artifactory_username: ${{ vars.ARTIFACTORY_USERNAME }}
79+
- uses: mongodb-labs/drivers-github-tools/python/publish@v2
80+
with:
81+
version: ${{ inputs.version }}
82+
following_version: ${{ inputs.following_version }}
83+
product_name: ${{ env.PRODUCT_NAME }}
84+
silk_asset_group: ${{ env.SILK_ASSET_GROUP }}
85+
token: ${{ github.token }}
86+
dry_run: ${{ inputs.dry_run }}

‎pyproject.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ Tracker = "https://jira.mongodb.org/projects/PYTHON/issues"
5050

5151
[tool.hatch.version]
5252
path = "pymongo/_version.py"
53+
validate-bump = false
5354

5455
[tool.hatch.build.targets.wheel]
5556
packages = ["bson","gridfs", "pymongo"]

0 commit comments

Comments
 (0)