From 39116d31e3b3cb391d5d753fd5f726c5d6850daf Mon Sep 17 00:00:00 2001 From: bigboateng Date: Sat, 1 Aug 2026 09:42:20 +0100 Subject: [PATCH] ci: publish Yield SDKs to OperatorStack registry --- .github/workflows/private-registry.yml | 148 +++++++++++++++++++++++++ 1 file changed, 148 insertions(+) create mode 100644 .github/workflows/private-registry.yml diff --git a/.github/workflows/private-registry.yml b/.github/workflows/private-registry.yml new file mode 100644 index 0000000..045f1c7 --- /dev/null +++ b/.github/workflows/private-registry.yml @@ -0,0 +1,148 @@ +name: Publish SDKs to OperatorStack Registry + +on: + push: + tags: ["v*"] + workflow_dispatch: + inputs: + version: + description: "Existing release version without the leading v" + required: true + default: "0.1.4" + type: string + +permissions: + contents: read + id-token: write + +concurrency: + group: publish-yield-sdks + cancel-in-progress: false + +jobs: + publish: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - uses: actions/setup-go@v5 + with: + go-version: stable + - uses: actions/setup-node@v4 + with: + node-version: "24" + - uses: actions/setup-python@v5 + with: + python-version: "3.11" + - uses: dtolnay/rust-toolchain@stable + + - id: version + name: Resolve published version + env: + REQUESTED_VERSION: ${{ inputs.version }} + run: | + set -euo pipefail + if [[ "$GITHUB_REF" == refs/tags/v* ]]; then + version="${GITHUB_REF_NAME#v}" + else + version="$REQUESTED_VERSION" + fi + [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] + git rev-parse --verify "refs/tags/v${version}" + test "$(git rev-list -n 1 "v${version}")" = "$GITHUB_SHA" + echo "version=$version" >> "$GITHUB_OUTPUT" + + - id: auth + uses: google-github-actions/auth@v2 + with: + workload_identity_provider: ${{ vars.WIF_PROVIDER }} + service_account: ${{ vars.DEPLOYER_SA_EMAIL }} + - uses: google-github-actions/setup-gcloud@v2 + + - name: Verify Go SDK and runtime + run: go test ./... + + - name: Publish Go module + run: | + set -euo pipefail + if gcloud artifacts versions describe "v${{ steps.version.outputs.version }}" \ + --project="${{ vars.AR_PROJECT }}" --location="${{ vars.AR_LOCATION }}" \ + --repository="${{ vars.AR_GO_REPO }}" --package=github.com/operatorstack/yield \ + >/dev/null 2>&1; then + echo "Go module already published." + else + gcloud artifacts go upload \ + --project="${{ vars.AR_PROJECT }}" \ + --location="${{ vars.AR_LOCATION }}" \ + --repository="${{ vars.AR_GO_REPO }}" \ + --module-path=github.com/operatorstack/yield \ + --version="v${{ steps.version.outputs.version }}" \ + --source=. + fi + + - name: Publish TypeScript SDK + working-directory: sdk/typescript + run: | + set -euo pipefail + if gcloud artifacts versions describe "${{ steps.version.outputs.version }}" \ + --project="${{ vars.AR_PROJECT }}" --location="${{ vars.AR_LOCATION }}" \ + --repository="${{ vars.AR_NPM_REPO }}" --package=@operatorstack/yield \ + >/dev/null 2>&1; then + echo "TypeScript SDK already published." + else + npm version "${{ steps.version.outputs.version }}" --no-git-tag-version --allow-same-version + gcloud artifacts print-settings npm \ + --project="${{ vars.AR_PROJECT }}" --location="${{ vars.AR_LOCATION }}" \ + --repository="${{ vars.AR_NPM_REPO }}" --scope=@operatorstack > .npmrc + npx -y google-artifactregistry-auth .npmrc + npm publish + fi + + - name: Build and publish Python SDK + working-directory: sdk/python + run: | + set -euo pipefail + if gcloud artifacts versions describe "${{ steps.version.outputs.version }}" \ + --project="${{ vars.AR_PROJECT }}" --location="${{ vars.AR_LOCATION }}" \ + --repository="${{ vars.AR_PYTHON_REPO }}" --package=yieldskill \ + >/dev/null 2>&1; then + echo "Python SDK already published." + else + sed -i 's/^version = .*/version = "${{ steps.version.outputs.version }}"/' pyproject.toml + python -m pip install --quiet build twine keyrings.google-artifactregistry-auth + python -m build + twine upload \ + --repository-url "https://${{ vars.AR_LOCATION }}-python.pkg.dev/${{ vars.AR_PROJECT }}/${{ vars.AR_PYTHON_REPO }}/" \ + dist/* + fi + + - name: Build Rust crate and sparse-index record + working-directory: sdk/rust + run: | + set -euo pipefail + version="${{ steps.version.outputs.version }}" + sed -i "s/^version = .*/version = \"${version}\"/" Cargo.toml + cargo package --allow-dirty + crate="target/package/yieldskill-${version}.crate" + checksum="$(sha256sum "$crate" | cut -d' ' -f1)" + curl -fsSL https://get.operatorstack.systems/cargo/index/yi/el/yieldskill \ + | grep -v "\"vers\":\"${version}\"" > yieldskill-index.json || true + jq -nc --arg vers "$version" --arg cksum "$checksum" '{ + name:"yieldskill",vers:$vers, + deps:[ + {name:"hex",req:"^0.4",features:[],optional:false,default_features:true,target:null,kind:"normal",registry:null}, + {name:"serde",req:"^1",features:["derive"],optional:false,default_features:true,target:null,kind:"normal",registry:null}, + {name:"serde_json",req:"^1",features:[],optional:false,default_features:true,target:null,kind:"normal",registry:null}, + {name:"sha2",req:"^0.10",features:[],optional:false,default_features:true,target:null,kind:"normal",registry:null} + ], + cksum:$cksum,features:{},yanked:false,links:null + }' >> yieldskill-index.json + mkdir publish + cp "$crate" yieldskill-index.json publish/ + gcloud artifacts generic upload \ + --project="${{ vars.AR_PROJECT }}" \ + --location="${{ vars.AR_LOCATION }}" \ + --repository="${{ vars.AR_GENERIC_REPO }}" \ + --package=yield-rust --version="$version" \ + --source-directory=publish --skip-existing