draft_release.yml

name: 'Release Draft'

on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'

permissions:
  actions: write
  deployments: write
  packages: write
  pull-requests: write
  repository-projects: write
  contents: write

jobs:
  python-wrapper-release-gh-draft:
    name: 'Build And Release Draft'
    runs-on: ubuntu-latest
    environment:
      name: draft_release
      url: https://test.pypi.org/project/aws-advanced-python-wrapper/
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
      - name: 'Set up Python 3.11'
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.11'
      - name: Install poetry
        shell: bash
        run: |
          pipx install poetry==1.8.2
          poetry config virtualenvs.prefer-active-python true
      - name: 'Install dependencies'
        run: poetry install
      - name: 'Run mypy - static type checking'
        run: poetry run mypy .
      - name: 'Run flake8 - linting'
        run: poetry run flake8 .
      - name: 'Run isort - dependency import sorting check'
        run: poetry run isort --check-only .
      - name: 'Run unit tests'
        run: poetry run pytest ./tests/unit -Werror
      - name: 'Set Version Env Variable'
        run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
      - name: 'Get Release Details'
        run: |
          export RELEASE_DETAILS="$(awk -vN=2 'n<N;/^## /{++n}' CHANGELOG.md)"
          export RELEASE_DETAILS="$(sed '${/^# /d;}' <<< "$RELEASE_DETAILS")"
          export RELEASE_DETAILS="$(sed '$d' <<< "$RELEASE_DETAILS")"
          touch RELEASE_DETAILS.md
          echo "$RELEASE_DETAILS" > RELEASE_DETAILS.md
      - name: 'Create a Package'
        run: poetry build
      # The tag, the GitHub draft release, and the eventual PyPI release all keep
      # the plain version. Only the TestPyPI upload carries an rc suffix, so a tag
      # can be re-cut without colliding with an immutable TestPyPI filename.
      # release.yml builds from the tag independently, so PyPI is unaffected.
      - name: 'Build A Release Candidate For TestPyPI'
        run: |
          set -euo pipefail
          # rc1 for the first candidate of a release version, then rc2, rc3, ...
          # The counter is read back from TestPyPI so no state is carried between
          # runs and a re-cut can never collide with an immutable filename.
          RC_VERSION="${RELEASE_VERSION}rc$(python .github/scripts/next_rc_number.py "$RELEASE_VERSION")"
          mv dist dist-release
          poetry version "$RC_VERSION"
          poetry build
          mv dist dist-rc
          mv dist-release dist
          poetry version "$RELEASE_VERSION"
          echo "Release candidate: pin testers to \`aws_advanced_python_wrapper==$RC_VERSION\`" >> $GITHUB_STEP_SUMMARY
      - name: 'Upload to TestPyPI'
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
        with:
          repository-url: https://test.pypi.org/legacy/
          packages-dir: dist-rc
      - name: 'Create a Draft Release'
        if: always()
        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd  # v1.21.0
        with:
          draft: true
          # Allow a tag to be re-cut: update the existing draft and replace its
          # artifacts instead of failing because the release already exists.
          allowUpdates: true
          replacesArtifacts: true
          # Never overwrite an already-published release: only a draft or
          # prerelease may be updated in place.
          updateOnlyUnreleased: true
          name: "AWS Advanced Python Wrapper - v${{ env.RELEASE_VERSION }}"
          bodyFile: RELEASE_DETAILS.md
          artifacts: ./dist/*
          token: ${{ secrets.GITHUB_TOKEN }}