Convert to a multi-step pipeline with all-in-one manual approved publ…

…ishing

.github/workflows/build-and-publish-pypi-on-tag.yml → .github/workflows/build-and-publish.yml

@@ -7,11 +7,15 @@ on:
 env:
   # Workarouund for no ternary operator, use short-circuiting
   VERSION: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || 'DEV' }}
+  MAC_PACKAGE: OpenCRAVAT.${{env.VERSION}}.pkg
+  WINDOWS_INSTALLER: OpenCRAVAT-${{env.VERSION}}.exe
+  DOCKER_TAG: {{ secrets.DOCKER_USERNAME }}/opencravat:${{env.VERSION }}
+  DOCKER_ARCHIVE: opencravat-docker-${{ env.VERSION }}.tgz
+  PYPI_SDIST: open-cravat-${{ env.VERSION }}.tar.gz
 
 jobs:
   pypi:
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Build pypi package
         run: echo "Building package on release"
@@ -20,28 +24,34 @@ jobs:
         with:
           fetch-depth: 0
       - run: python setup.py sdist --formats=gztar
-      - name: Publish package
-        uses: pypa/gh-action-pypi-publish@release/v1
+      - name: Archive Image File
+        uses: actions/upload-artifact@v4
         with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
+          # the odd path here is to force the action to preseve
+          # directory structure in the zipfile
+          name: ${{ env.PYPI_SDIST }}
+          path: ./dist/${{ env.PYPI_SDIST }}
 
   docker:
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/')
+    env:
+      image_tag: ${{ secrets.DOCKER_USERNAME }}/opencravat:${{ VERSION }}
     steps:
       - uses: actions/checkout@v4
-      - name: Login to Docker Hub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Build and push Docker image
+      - name: Build Docker image
         uses: docker/build-push-action@v2
         with:
           context: .
-          push: true
-          build-args: BRANCH=${{github.ref}}
-          tags: ${{ secrets.DOCKER_USERNAME }}/opencravat:${{ github.sha }}
+          load: true
+          tags: ${{ env.DOCKER_TAG }}
+      - name: Save docker image
+        run: |
+          docker image save ${{ env.DOCKER_TAG }} | gzip > opencravat-docker-${{ env.VERSION }}.tgz
+      - name: Archive installer package
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.DOCKER_ARCHIVE }}
+          path: ${{ env.DOCKER_ARCHIVE }}
 
   windows:
     runs-on: windows-latest
@@ -59,17 +69,10 @@ jobs:
           .\build.ps1 ..\.. ${{env.VERSION}} -Clean -ForceDownload -Build
       - name: Archive installer package
         uses: actions/upload-artifact@v4
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         with:
-          name: OpenCRAVAT-${{env.VERSION}}.exe
-          path: .build\windows\Output\OpenCRAVAT-${{env.VERSION}}.exe
-      - name: Release
-        uses: softprops/action-gh-release@v2
-        if: startsWith(github.ref, 'refs/tags/')
-        with:
-          draft: true
-          files: |
-            .build/windows/Output/OpenCRAVAT-${{env.VERSION}}.exe
+          name: ${{ env.WINDOWS_INSTALLER }}
+          path: .build\windows\Output\${{ env.WINDOWS_INSTALLER }}
+
 
   mac:
     runs-on: macos-14
@@ -105,14 +108,55 @@ jobs:
           ./package.sh $VERSION
       - name: Archive installer package
         uses: actions/upload-artifact@v4
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         with:
-          name: OpenCRAVAT.${{env.VERSION}}.pkg
-          path: .build/mac/OpenCRAVAT.${{env.VERSION}}.pkg
-      - name: Release
+          name: ${{ env.MAC_PACKAGE }}
+          path: .build/mac/${{ env.MAC_PACKAGE }}
+
+
+  publish:
+    runs-on: ubuntu-latest
+    needs:
+      - mac
+      - windows
+      - pypi
+      - docker
+    environment: Published
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      # Downloads all the artifacts from above, and extract them into
+      # a directory named after the artifact itself, but since the
+      # artifacts are all named after their contained package the naming
+      # looks weird.
+      # An artifact named OpenCravat-2.5.0.exe.zip will extract to a
+      # directory named OpenCravat-2.5.0.exe and contain
+      # OpenCravat-2.5.0.exe
+      - name: Download all workflow run artifacts
+        uses: actions/download-artifact@v4
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Load Docker Image
+        run: |
+          docker load -i ${{ env.DOCKER_ARCHIVE }}/${{ env.DOCKER_ARCHIVE }}
+      - name: Login to Docker Hub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      # this should only push since the tagged image was loaded above
+      - name: Publish Docker image
+        run: |
+          docker push ${{ env.DOCKER_TAG }}
+      - name: Publish to PyPi
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: ${{ env.PYPI_SDIST }}
+          password: ${{ secrets.PYPI_API_TOKEN }}
+      - name: Release Images
         uses: softprops/action-gh-release@v2
-        if: startsWith(github.ref, 'refs/tags/')
         with:
           draft: true
           files: |
-            .build/mac/OpenCRAVAT.${{env.VERSION}}.pkg
+            - ${{ env.MAC_PACKAGE }}/${{ env.MAC_PACKAGE }}
+            - ${{ env.WINDOWS_INSTALLER }}/${{ env.WINDOWS_INSTALLER }}