validate-python-release.yaml

name: Validate Python release
on:
  workflow_call:
    outputs:
      distributions-artifact-id:
        description: Upload ID for the validated wheel and sdist artifact
        value: ${{ jobs.build.outputs.artifact-id }}
    inputs:
      source:
        description: Package source directory
        default: .
        type: string
      artifact-prefix:
        description: Prefix for distribution artifacts in a multi-package release
        default: ""
        type: string
permissions:
  contents: read
jobs:
  source-check:
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ github.sha }}
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          version: latest-known
          python-version: "3.15"
          enable-cache: false
      - uses: $/install-locked-tools
        with:
          groups: release-check
          venv: ${{ runner.temp }}/release-tools
      - name: Run tagged source checks
        env:
          UV_EXCLUDE_NEWER: 7 days
        run: >-
          "$RUNNER_TEMP/release-tools/bin/prek" run --all-files
  constraints:
    runs-on: ubuntu-26.04
    outputs:
      artifact-id: ${{ steps.upload.outputs.artifact-id }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ github.sha }}
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          version: latest-known
          python-version: "3.15"
          enable-cache: false
      - id: constraints
        uses: $/install-locked-tools
      - name: Stage build constraints
        env:
          SOURCE: ${{ steps.constraints.outputs.build-constraints }}
        run: cp "$SOURCE" "$RUNNER_TEMP/build-constraints.txt"
      - id: upload
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ inputs.artifact-prefix }}build-constraints
          path: ${{ runner.temp }}/build-constraints.txt
          if-no-files-found: error
  build:
    needs: constraints
    runs-on: ubuntu-26.04
    outputs:
      artifact-id: ${{ steps.upload.outputs.artifact-id }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ github.sha }}
      - name: Verify the exact release tag
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          test "$GITHUB_REF" = "refs/tags/$TAG"
          git check-ref-format "refs/tags/$TAG"
          test "$(git rev-parse "refs/tags/$TAG^{commit}")" = "$(git rev-parse HEAD)"
          git merge-base --is-ancestor HEAD origin/main
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          version: latest-known
          python-version: "3.15"
          enable-cache: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.constraints.outputs.artifact-id }}
          path: ${{ runner.temp }}
      - name: Require empty distribution directory
        run: test ! -d dist || test -z "$(find dist -mindepth 1 -maxdepth 1 -print -quit)"
      - name: Select build interpreter
        run: uv venv --python 3.15 "$RUNNER_TEMP/build-python"
      - name: Build wheel and sdist
        env:
          SOURCE: ${{ inputs.source }}
        run: |
          set -euo pipefail
          build_python=$(uv python find "$RUNNER_TEMP/build-python")
          export SOURCE_DATE_EPOCH
          SOURCE_DATE_EPOCH=$(git -C "$SOURCE" log -1 --format=%ct)
          uv build --python "$build_python" --python-preference only-managed --sdist --wheel \
            --build-constraints "$RUNNER_TEMP/build-constraints.txt" --require-build-hashes "$SOURCE" --out-dir dist
      - name: Match distribution version to tag
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          version=${TAG#v}
          wheels=(dist/*-"$version"-*.whl)
          sdists=(dist/*-"$version".tar.gz)
          files=(dist/*)
          if [[ ${#wheels[@]} -ne 1 || ${#sdists[@]} -ne 1 || ${#files[@]} -ne 2 ]]; then
            echo "::error::wheel and sdist versions must match $TAG" >&2
            exit 1
          fi
      - id: upload
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ inputs.artifact-prefix }}python-package-distributions
          path: dist/*
          if-no-files-found: error
  validate:
    needs: build
    runs-on: ubuntu-26.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ github.sha }}
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          version: latest-known
          python-version: "3.15"
          enable-cache: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ needs.build.outputs.artifact-id }}
          path: dist
      - name: Install distribution validators
        run: |
          uv venv --python 3.15 "$RUNNER_TEMP/package-validators"
          uv pip install --python "$RUNNER_TEMP/package-validators" 'twine>=7' 'check-wheel-contents>=0.6.3'
      - name: Check distribution metadata
        run: uv run --no-project --python "$RUNNER_TEMP/package-validators" twine check dist/*
      - name: Check wheel contents
        run: uv run --no-project --python "$RUNNER_TEMP/package-validators" check-wheel-contents --no-config dist