release_flow.yml

# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: Build and Publish CLI Release

on:
  release:
    types:
      - created

permissions:
  contents: read

jobs:
  build_for_pypi:
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: read # This is required for actions/checkout
    uses: ./.github/workflows/build_for_pypi.yml
    secrets: inherit

  buildassets:
    name: Build packages
    permissions:
      contents: write # required so the reusable workflow can attach release assets
    uses: ./.github/workflows/build_assets.yml
    with:
      release: true
    secrets: inherit

  publish_to_pypi:
    needs:
      - build_for_pypi
    permissions:
      id-token: write # This is required for OIDC
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/codecov-cli
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: dist/
          pattern: cibw-*
          merge-multiple: true

      - name: List artifacts
        run: ls -alR dist/

      - name: Publish package to PyPi
        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
        with:
          verbose: true
          packages-dir: dist/

  publish_release:
    name: Publish release
    needs: [buildassets, publish_to_pypi]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - id: auth
        name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v1.0.0
        with:
          create_credentials_file: true
          workload_identity_provider: ${{ secrets.CODECOV_GCP_WIDP }}
          service_account: ${{ secrets.CODECOV_GCP_WIDSA }}

      - name: Publish a message to a Pub/Sub topic
        env:
          CLOUDSDK_CORE_PROJECT: ${{ secrets.GCLOUD_UPLOADER_PROJECT_ID }}
        run: |
          gcloud pubsub topics publish ${{ secrets.GCLOUD_UPLOADER_PUBSUB_TOPIC }} --message '{"release":"'"${{ github.ref_name }}"'", "latest":true}'