amplifier-unified/.github/workflows/kernels-release.yml at main · microsoft/amplifier-unified · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
name: Kernels package
on:
  pull_request:
    paths:
      - components/kernels/**
      - scripts/scheduling_release.py
      - tests/test_scheduling_release.py
      - .github/workflows/kernels-release.yml
  workflow_dispatch:
    inputs:
      revision:
        description: Full merged main commit SHA containing the kernels source to publish
        required: true
        type: string
permissions:
  contents: read
concurrency:
  group: kernels-package-${{ github.event_name == 'workflow_dispatch' && 'publication' || github.ref }}
  cancel-in-progress: false
jobs:
  build:
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    outputs:
      revision: ${{ steps.selection.outputs.revision }}
      version: ${{ steps.selection.outputs.version }}
      subdirectory: ${{ steps.selection.outputs.subdirectory }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: '3.13'
      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
        with:
          enable-cache: false
      - name: Select exact source and qualify publication controls
        id: selection
        env:
          SELECTED_REVISION: ${{ inputs.revision || github.sha }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          flags=()
          if [ "$EVENT_NAME" = pull_request ]; then flags+=(--qualification); fi
          python scripts/scheduling_release.py plan --component kernels --revision "$SELECTED_REVISION" "${flags[@]}" --output "$GITHUB_OUTPUT"
          uv run --no-project --with 'pytest>=8' python -m pytest -q tests/test_scheduling_release.py
      - name: Build once from selected standalone source
        env:
          SELECTED_REVISION: ${{ steps.selection.outputs.revision }}
          PROJECT_PATH: ${{ steps.selection.outputs.subdirectory }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          mkdir "$RUNNER_TEMP/kernels-source"
          git archive "$SELECTED_REVISION" "$PROJECT_PATH" | tar -x -C "$RUNNER_TEMP/kernels-source"
          uv build --sdist --wheel --out-dir "$RUNNER_TEMP/kernels-dist" "$RUNNER_TEMP/kernels-source/$PROJECT_PATH"
          rm -f "$RUNNER_TEMP/kernels-dist/.gitignore" # uv output sentinel, not a release asset.
          flags=()
          if [ "$EVENT_NAME" = pull_request ]; then flags+=(--qualification); fi
          python scripts/scheduling_release.py seal --component kernels --revision "$SELECTED_REVISION" --dist "$RUNNER_TEMP/kernels-dist" "${flags[@]}"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: kernels-distributions
          path: ${{ runner.temp }}/kernels-dist/*
          if-no-files-found: error
  installed:
    needs: build
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: '3.13'
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '22.23.3'
      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
        with:
          enable-cache: false
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: kernels-distributions
          path: ${{ runner.temp }}/kernels-dist
      - name: Verify original bytes and test the installed wheel outside checkout
        env:
          SELECTED_REVISION: ${{ needs.build.outputs.revision }}
          PACKAGE_VERSION: ${{ needs.build.outputs.version }}
          PROJECT_PATH: ${{ needs.build.outputs.subdirectory }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          flags=()
          if [ "$EVENT_NAME" = pull_request ]; then flags+=(--qualification); fi
          python scripts/scheduling_release.py verify --component kernels --revision "$SELECTED_REVISION" --dist "$RUNNER_TEMP/kernels-dist" "${flags[@]}"
          uv venv --python 3.13 "$RUNNER_TEMP/kernels-installed"
          python_path="$RUNNER_TEMP/kernels-installed/bin/python"
          mkdir "$RUNNER_TEMP/kernels-peers"
          # Public test peers only; Core is an undeclared import of this BashTool.
          operations_wheel="$RUNNER_TEMP/kernels-peers/amplifier_operations-0.1.0-py3-none-any.whl"
          core_wheel="$RUNNER_TEMP/kernels-peers/amplifier_core-2.0.2-cp311-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
          curl --fail --location --output "$operations_wheel" https://github.com/microsoft/amplifier-unified/releases/download/operations-v0.1.0/amplifier_operations-0.1.0-py3-none-any.whl
          curl --fail --location --output "$core_wheel" https://files.pythonhosted.org/packages/e5/76/b58ae511f00c3ba2774213c2d336a6c2e29c94819280df5e52b136b6dae3/amplifier_core-2.0.2-cp311-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
          printf '%s  %s\n' 05675519079bbfb75be9ce0bc6fcba8c4a4ba6fd06dc8105ca706aec5ac43a1a "$operations_wheel" 50406335d88598d6b4cba90f8598e7774d2b9b189e9d3992a09474b777036f9f "$core_wheel" | sha256sum --check
          uv pip install --python "$python_path" --only-binary amplifier-core "$RUNNER_TEMP/kernels-dist/amplifier_kernels-$PACKAGE_VERSION-py3-none-any.whl[test]" "$operations_wheel" "$core_wheel" 'amplifier-module-tool-bash @ git+https://github.com/microsoft/amplifier-module-tool-bash@d5bb46d24dcae8e260211bf8fb5c22de3a67f406'
          uv pip freeze --python "$python_path" > "$RUNNER_TEMP/kernels-peers/installed.txt"
          mkdir "$RUNNER_TEMP/kernels-tests"
          git archive "$SELECTED_REVISION:$PROJECT_PATH" tests pyproject.toml | tar -x -C "$RUNNER_TEMP/kernels-tests"
          cd "$RUNNER_TEMP/kernels-tests"
          "$python_path" -I -c 'from pathlib import Path; import sys,importlib.util,amplifier_kernels; assert Path(amplifier_kernels.__file__).resolve().is_relative_to(Path(sys.prefix).resolve()); assert all(importlib.util.find_spec(name) is None for name in ("amplifier_web","amplifier_foundation")); import amplifier_module_tool_bash,amplifier_core,amplifier_operations; assert (Path(amplifier_kernels.__file__).parent / "node_runner.cjs").is_file()'
          "$python_path" -I -m pytest -q tests --junitxml=installed-tests.xml
          "$python_path" -I -c 'import xml.etree.ElementTree as E; cases=E.parse("installed-tests.xml").findall(".//testcase"); assert len(cases)==10 and all(not list(case) for case in cases), "All ten Python/Node mechanism cases must pass without skips"'
          uv pip check --python "$python_path"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: always()
        with:
          name: kernels-installed-linux
          path: |
            ${{ runner.temp }}/kernels-tests/installed-tests.xml
            ${{ runner.temp }}/kernels-peers/installed.txt
          if-no-files-found: error
  publish:
    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'
    needs: [build, installed]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: '3.13'
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: kernels-distributions
          path: ${{ runner.temp }}/kernels-dist
      - name: Publish or verify the exact component release without replacing the app latest
        env:
          GH_TOKEN: ${{ github.token }}
          SELECTED_REVISION: ${{ needs.build.outputs.revision }}
        run: python scripts/scheduling_release.py publish --component kernels --revision "$SELECTED_REVISION" --dist "$RUNNER_TEMP/kernels-dist"