Skip to content

Create truss RC packages through GHA #2002

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
+65 −0
Open

Create truss RC packages through GHA #2002

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4fa75fc
initial commit for rc release CI
ndeepak-baseten Oct 21, 2025
5c40ed8
allow some users for rc, prevent concurrent runs
ndeepak-baseten Oct 21, 2025
60836c6
validate input rc with the version in uv.lock and pyproject.toml
ndeepak-baseten Oct 21, 2025
5942464
validate rc version within uv.lock and pyproject.toml
ndeepak-baseten Oct 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 65 additions & 0 deletions .github/workflows/create-rc-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
# .github/workflows/create-rc-release.yml
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alternatively, I could add one more conditional to "Main - post-commit" to jump straight to package publishing. However, this workflow also runs validations for rc versions. Not heavily opinionated.

name: Create RC Release

on:
workflow_dispatch:

# Prevent multiple simultaneous runs for security purposes
concurrency:
group: create-rc-release
cancel-in-progress: false

jobs:
publish-rc-only:
runs-on: ubuntu-22.04
permissions:
id-token: write
steps:
- name: Check user permissions
run: |
# Only allow specific users to trigger (from secret)
ALLOWED_USERS="${{ secrets.RC_RELEASE_ALLOWED_USERS }}"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mainly for security reasons. Can follow any prior best practice if available.

if [[ -z "$ALLOWED_USERS" ]]; then
echo "❌ RC_RELEASE_ALLOWED_USERS secret not configured"
exit 1
fi
if [[ ! "$ALLOWED_USERS" =~ "${{ github.actor }}" ]]; then
echo "❌ User ${{ github.actor }} not authorized for RC releases"
exit 1
fi

- name: Validate version consistency
run: |
# Get version from pyproject.toml
VERSION=$(grep '^version = ' pyproject.toml | cut -d'"' -f2)

# Validate version format
if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+rc[0-9]+$ ]]; then
echo "❌ Invalid version format in pyproject.toml: $VERSION"
echo "✅ Expected format: X.Y.ZrcN (e.g., 0.11.13rc1)"
exit 1
fi

# Check uv.lock version matches pyproject.toml
UV_LOCK_VERSION=$(grep -A1 'name = "truss"' uv.lock | grep 'version = ' | cut -d'"' -f2)
if [[ "$UV_LOCK_VERSION" != "$VERSION" ]]; then
echo "❌ Version mismatch between pyproject.toml and uv.lock"
echo " pyproject.toml: $VERSION"
echo " uv.lock: $UV_LOCK_VERSION"
echo " Please run 'uv lock' to update uv.lock"
exit 1
fi

echo "✅ Version consistency validated: $VERSION"

- uses: ./.github/actions/setup-python/

- name: Install packages
run: uv sync --no-dev
- name: Build
run: uv build
- name: Publish package to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
with:
verbose: true
print-hash: true
Loading