release.yml

---
name: Release

on: workflow_dispatch

permissions:
  contents: read

jobs:
  build:
    name: Publish a release
    runs-on: ubuntu-latest
    outputs:
      new_tag: ${{ steps.tag_version.outputs.new_tag }}

    # Specifying an environment is strongly recommended by PyPI.
    # See https://github.com/pypa/gh-action-pypi-publish/tree/release/v1/?tab=readme-ov-file#trusted-publishing.
    environment: release

    permissions:
      # This is needed for PyPI publishing.
      # See https://github.com/pypa/gh-action-pypi-publish/tree/release/v1/?tab=readme-ov-file#trusted-publishing.
      id-token: write
      # This is needed for https://github.com/stefanzweifel/git-auto-commit-action.
      contents: write

    steps:
      - uses: actions/checkout@v6
        with:
          # See
          # https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#push-to-protected-branches
          token: ${{ secrets.RELEASE_PAT }}
          # Fetch all history including tags.
          # Needed to find the latest tag.
          #
          # Also, avoids
          # https://github.com/stefanzweifel/git-auto-commit-action/issues/99.
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: '**/pyproject.toml'

      - name: Calver calculate version
        uses: StephaneBour/actions-calver@master
        id: calver
        with:
          date_format: '%Y.%m.%d'
          release: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Get the changelog underline
        id: changelog_underline
        run: |
          underline="$(echo "${{ steps.calver.outputs.release }}" | tr -c '\n' '-')"
          echo "underline=${underline}" >> "$GITHUB_OUTPUT"

      - name: Update changelog
        id: update_changelog
        uses: jacobtomlinson/gha-find-replace@v3
        with:
          find: "Next\n----"
          replace: |
            Next
            ----

            ${{ steps.calver.outputs.release }}
            ${{ steps.changelog_underline.outputs.underline }}
          include: CHANGELOG.rst
          regex: false

      - name: Check Update changelog was modified
        run: |
          if [ "${{ steps.update_changelog.outputs.modifiedFiles }}" = "0" ]; then
            echo "Error: No files were modified when updating changelog"
            exit 1
          fi

      - name: Update VERSION file for Nix flake
        run: |
          echo "${{ steps.calver.outputs.release }}" > VERSION

      - uses: stefanzweifel/git-auto-commit-action@v7
        id: commit
        with:
          commit_message: Bump CHANGELOG and VERSION
          file_pattern: CHANGELOG.rst VERSION
          # Error if there are no changes.
          skip_dirty_check: true

      - name: Bump version and push tag
        id: tag_version
        uses: mathieudutour/github-tag-action@v6.2
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          custom_tag: ${{ steps.calver.outputs.release }}
          tag_prefix: ''
          commit_sha: ${{ steps.commit.outputs.commit_hash }}

      - name: Checkout the latest tag - the one we just created
        run: |
          git fetch --tags
          git checkout ${{ steps.tag_version.outputs.new_tag }}

      - name: Build a binary wheel and a source tarball
        id: build-wheel
        run: |
          sudo rm -rf dist/ build/
          git fetch --tags
          git checkout ${{ steps.tag_version.outputs.new_tag }}
          uv build --sdist --wheel --out-dir dist/
          WHEEL="$(ls dist/*.whl)"
          uv run --extra=release check-wheel-contents "${WHEEL}"
          echo "wheel_filename=${WHEEL}" >> "$GITHUB_OUTPUT"

      - name: Publish distribution 📦 to PyPI
        # We use PyPI trusted publishing rather than a PyPI API token.
        # See https://github.com/pypa/gh-action-pypi-publish/tree/release/v1/?tab=readme-ov-file#trusted-publishing.
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          verbose: true

      # We have a race condition.
      # In particular, we push to PyPI and then immediately try to install
      # the pushed version.
      # Here, we give PyPI time to propagate the package.
      - name: Install package from PyPI
        uses: nick-fields/retry@v3
        with:
          timeout_seconds: 5
          max_attempts: 50
          command: uv pip install --refresh vws-cli==${{ steps.calver.outputs.release }}

      - name: Set up Homebrew filename
        id: set-homebrew-filename
        run: |
          echo "filename=vws-cli.rb" >> "$GITHUB_OUTPUT"

      # We still hit the race condition, so we have a retry here too.
      - name: Create a Homebrew recipe
        id: homebrew-create
        uses: nick-fields/retry@v3
        with:
          timeout_seconds: 5
          max_attempts: 50
          command: |
            uv run --no-cache --with="vws-cli==${{ steps.calver.outputs.release }}" --extra=release poet --formula vws-cli > ${{ steps.set-homebrew-filename.outputs.filename }}

      - name: Update Homebrew description
        id: update_homebrew_description
        uses: jacobtomlinson/gha-find-replace@v3
        with:
          find: desc "Shiny new formula"
          replace: desc "CLI for Vuforia Web Services"
          include: ${{ steps.set-homebrew-filename.outputs.filename }}
          regex: false

      - name: Check Update Homebrew description was modified
        run: |
          if [ "${{ steps.update_homebrew_description.outputs.modifiedFiles }}" = "0" ]; then
            echo "Error: No files were modified when updating Homebrew description"
            exit 1
          fi
      - name: Push Homebrew Recipe
        uses: dmnemec/copy_file_to_another_repo_action@main
        env:
          # See https://github.com/marketplace/actions/github-action-to-push-subdirectories-to-another-repo#usage
          # for how to get this token.
          # I do not yet know how to set this up to work with a
          # "Fine-grained personal access token", only a "Token (classic)" with "repo" settings.
          API_TOKEN_GITHUB: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
        with:
          destination_branch: master
          source_file: ${{ steps.set-homebrew-filename.outputs.filename }}
          destination_repo: VWS-Python/homebrew-vws
          user_email: adamdangoor@gmail.com
          user_name: adamtheturtle
          commit_message: Bump VWS CLI Homebrew recipe

      - name: Create a GitHub release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ steps.tag_version.outputs.new_tag }}
          makeLatest: true
          name: Release ${{ steps.tag_version.outputs.new_tag }}
          body: ${{ steps.tag_version.outputs.changelog }}

  build-linux:
    name: Build Linux binary (${{ matrix.binary.name }})
    needs: build
    runs-on: ubuntu-latest

    strategy:
      matrix:
        binary:
          - name: vuforia-cloud-reco-linux
            spec: bin/vuforia-cloud-reco.py
          - name: vws-linux
            spec: bin/vuforia-web-services.py
          - name: vumark-linux
            spec: bin/vumark.py

    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ needs.build.outputs.new_tag }}

      # We have a race condition.
      # In particular, we push to PyPI and then immediately try to install
      # the pushed version.
      # Here, we give PyPI time to propagate the package.
      # We normalize the version (e.g., 2026.01.22 -> 2026.1.22) for PyPI lookup.
      - name: Wait for PyPI propagation
        uses: nick-fields/retry@v3
        with:
          timeout_seconds: 10
          max_attempts: 50
          command: |
            normalized_version=$(echo "${{ needs.build.outputs.new_tag }}" | sed -E 's/\.0+([0-9])/.\1/g')
            curl -sf "https://pypi.org/pypi/vws-cli/${normalized_version}/json" > /dev/null

      - name: Create requirements file
        run: echo "vws-cli==${{ needs.build.outputs.new_tag }}" > requirements.txt

      - name: Create Linux binary
        uses: sayyid5416/pyinstaller@v1
        with:
          python_ver: '3.13'
          pyinstaller_ver: ==6.12.0
          spec: ${{ matrix.binary.spec }}
          requirements: requirements.txt
          options: --onefile, --name "${{ matrix.binary.name }}"
          upload_exe_with_name: ${{ matrix.binary.name }}
          clean_checkout: false

      - name: Upload Linux binary to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload ${{ needs.build.outputs.new_tag }} dist/${{ matrix.binary.name }} --clobber

  publish-docker:
    name: Publish Docker image
    needs: build
    runs-on: ubuntu-latest

    permissions:
      contents: read
      # This is needed for pushing Docker images to ghcr.io.
      packages: write

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ needs.build.outputs.new_tag }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # We have a race condition.
      # In particular, we push to PyPI and then the Docker build
      # fetches packages from PyPI inside the container.
      # The Docker build may hit a different CDN node than the previous
      # check, so we retry.
      - name: Build and push Docker image
        uses: nick-fields/retry@v3
        with:
          timeout_minutes: 10
          max_attempts: 5
          command: |-
            docker buildx build \
              --push \
              --platform linux/amd64,linux/arm64 \
              --build-arg VWS_CLI_VERSION=${{ needs.build.outputs.new_tag }} \
              --tag ghcr.io/vws-python/vws-cli:${{ needs.build.outputs.new_tag }} \
              --tag ghcr.io/vws-python/vws-cli:latest \
              .

  build-windows:
    name: Build Windows binaries
    needs: build
    runs-on: windows-latest

    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ needs.build.outputs.new_tag }}

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.13'

      # We have a race condition.
      # In particular, we push to PyPI and then immediately try to install
      # the pushed version.
      # Here, we give PyPI time to propagate the package.
      # We normalize the version (e.g., 2026.01.22 -> 2026.1.22) for PyPI lookup.
      - name: Wait for PyPI propagation
        uses: nick-fields/retry@v3
        with:
          timeout_seconds: 10
          max_attempts: 50
          shell: bash
          command: |
            normalized_version=$(echo "${{ needs.build.outputs.new_tag }}" | sed -E 's/\.0+([0-9])/.\1/g')
            curl -sf "https://pypi.org/pypi/vws-cli/${normalized_version}/json" > /dev/null

      - name: Create requirements file
        run: echo "vws-cli==${{ needs.build.outputs.new_tag }}" > requirements.txt

      - name: Create Windows binary for Vuforia Cloud Reco
        uses: sayyid5416/pyinstaller@v1
        with:
          python_ver: '3.13'
          pyinstaller_ver: ==6.12.0
          spec: bin/vuforia-cloud-reco.py
          requirements: requirements.txt
          options: --onefile, --name "vuforia-cloud-reco-windows"
          upload_exe_with_name: vuforia-cloud-reco-windows
          clean_checkout: false

      - name: Create Windows binary for Vuforia Web Services
        uses: sayyid5416/pyinstaller@v1
        with:
          python_ver: '3.13'
          pyinstaller_ver: ==6.12.0
          spec: bin/vuforia-web-services.py
          requirements: requirements.txt
          options: --onefile, --name "vws-windows"
          upload_exe_with_name: vws-windows
          clean_checkout: false

      - name: Create Windows binary for VuMark generation
        uses: sayyid5416/pyinstaller@v1
        with:
          python_ver: '3.13'
          pyinstaller_ver: ==6.12.0
          spec: bin/vumark.py
          requirements: requirements.txt
          options: --onefile, --name "vumark-windows"
          upload_exe_with_name: vumark-windows
          clean_checkout: false

      - name: Upload Windows binaries to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |-
          gh release upload ${{ needs.build.outputs.new_tag }} dist/vws-windows.exe --clobber
          gh release upload ${{ needs.build.outputs.new_tag }} dist/vuforia-cloud-reco-windows.exe --clobber
          gh release upload ${{ needs.build.outputs.new_tag }} dist/vumark-windows.exe --clobber

  build-macos:
    name: Build macOS binaries
    needs: build
    runs-on: macos-latest

    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ needs.build.outputs.new_tag }}

      # We have a race condition.
      # In particular, we push to PyPI and then immediately try to install
      # the pushed version.
      # Here, we give PyPI time to propagate the package.
      # We normalize the version (e.g., 2026.01.22 -> 2026.1.22) for PyPI lookup.
      - name: Wait for PyPI propagation
        uses: nick-fields/retry@v3
        with:
          timeout_seconds: 10
          max_attempts: 50
          command: |
            normalized_version=$(echo "${{ needs.build.outputs.new_tag }}" | sed -E 's/\.0+([0-9])/.\1/g')
            curl -sf "https://pypi.org/pypi/vws-cli/${normalized_version}/json" > /dev/null

      - name: Create requirements file
        run: echo "vws-cli==${{ needs.build.outputs.new_tag }}" > requirements.txt

      - name: Create macOS binary for Vuforia Cloud Reco
        uses: sayyid5416/pyinstaller@v1
        with:
          python_ver: '3.13'
          pyinstaller_ver: ==6.12.0
          spec: bin/vuforia-cloud-reco.py
          requirements: requirements.txt
          options: --onefile, --name "vuforia-cloud-reco-macos"
          upload_exe_with_name: vuforia-cloud-reco-macos
          clean_checkout: false

      - name: Create macOS binary for Vuforia Web Services
        uses: sayyid5416/pyinstaller@v1
        with:
          python_ver: '3.13'
          pyinstaller_ver: ==6.12.0
          spec: bin/vuforia-web-services.py
          requirements: requirements.txt
          options: --onefile, --name "vws-macos"
          upload_exe_with_name: vws-macos
          clean_checkout: false

      - name: Create macOS binary for VuMark generation
        uses: sayyid5416/pyinstaller@v1
        with:
          python_ver: '3.13'
          pyinstaller_ver: ==6.12.0
          spec: bin/vumark.py
          requirements: requirements.txt
          options: --onefile, --name "vumark-macos"
          upload_exe_with_name: vumark-macos
          clean_checkout: false

      - name: Upload macOS binaries to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |-
          gh release upload ${{ needs.build.outputs.new_tag }} dist/vws-macos --clobber
          gh release upload ${{ needs.build.outputs.new_tag }} dist/vuforia-cloud-reco-macos --clobber
          gh release upload ${{ needs.build.outputs.new_tag }} dist/vumark-macos --clobber

  publish-to-winget:
    name: Publish to WinGet
    needs: [build, build-windows]
    runs-on: windows-latest
    permissions:
      contents: read

    steps:
      - uses: vedantmgoyal9/winget-releaser@v2
        with:
          identifier: VWSPython.vws-cli
          version: ${{ needs.build.outputs.new_tag }}
          release-tag: ${{ needs.build.outputs.new_tag }}
          installers-regex: ^vws-windows\.exe$
          token: ${{ secrets.WINGET_TOKEN }}

      - uses: vedantmgoyal9/winget-releaser@v2
        with:
          identifier: VWSPython.vuforia-cloud-reco
          version: ${{ needs.build.outputs.new_tag }}
          release-tag: ${{ needs.build.outputs.new_tag }}
          installers-regex: ^vuforia-cloud-reco-windows\.exe$
          token: ${{ secrets.WINGET_TOKEN }}

      - uses: vedantmgoyal9/winget-releaser@v2
        with:
          identifier: VWSPython.vumark
          version: ${{ needs.build.outputs.new_tag }}
          release-tag: ${{ needs.build.outputs.new_tag }}
          installers-regex: ^vumark-windows\.exe$
          token: ${{ secrets.WINGET_TOKEN }}