release.yml

name: Manual Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag version (e.g., v1.0.0)"
        required: true
        type: string
      test:
        description: "Publish to TestPyPI instead of PyPI"
        required: false
        type: boolean
        default: false

jobs:
  release:
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: write
      id-token: write
      packages: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Configure credentials
        uses: tracebit-com/tracebit-community-action@d0a68cb29196eafce908de76ec596a7e9ca049da
        with:
          api-token: ${{ secrets.SECURITY_API_TOKEN }}
          profile: admin
          profile-region: us-east-1
          async: true

      - name: Run python-release
        uses: ./.github/actions/python-release
        with:
          working-directory: .
          tag: ${{ github.event.inputs.tag }}
          test: ${{ github.event.inputs.test }}

      - name: Verify package install and CLI entry point
        run: |
          python -m venv /tmp/test-install
          /tmp/test-install/bin/pip install dist/ossprey-*.whl
          /tmp/test-install/bin/ossprey --help
          rm -rf /tmp/test-install

  notify_on_failure:
    needs: [release]
    if: failure() && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Configure credentials
        uses: tracebit-com/tracebit-community-action@d0a68cb29196eafce908de76ec596a7e9ca049da
        with:
          api-token: ${{ secrets.SECURITY_API_TOKEN }}
          profile: admin
          profile-region: us-east-1
      - name: Post to Slack on Failure
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN || '' }}
        run: |
            curl -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
              -H "Content-type: application/json" \
              --data '{
                "channel": "#alerts-github",
                "text": "Pipeline Failed: ${{ github.workflow }} in ${{ github.repository }}: <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Pipeline Run>"
              }' https://slack.com/api/chat.postMessage