release_flow.yml

# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: Build and Publish CLI Release

on:
  release:
    types:
      - created

jobs:
  build_and_publish_to_pypi:
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: read  # This is required for actions/checkout
    uses: ./.github/workflows/build_for_pypi.yml
    with:
      publish: true
    secrets: inherit

  buildassets:
    name: Build packages
    uses: ./.github/workflows/build_assets.yml
    with:
      release: true
    secrets: inherit

  publish_release:
    name: Publish release
    needs: [buildassets, build_and_publish_to_pypi]
    runs-on: ubuntu-latest
    permissions:
      contents: 'read'
      id-token: 'write'
    steps:
      - id: 'auth'
        name: 'Authenticate to Google Cloud'
        uses: 'google-github-actions/auth@v1.0.0'
        with:
          create_credentials_file: 'true'
          workload_identity_provider: ${{ secrets.CODECOV_GCP_WIDP }}
          service_account: ${{ secrets.CODECOV_GCP_WIDSA }}

      # Publish the release tag to a Pub/Sub topic
      - name: Publish a message to a Pub/Sub topic
        env:
          CLOUDSDK_CORE_PROJECT: ${{ secrets.GCLOUD_UPLOADER_PROJECT_ID }}
        run: |
          gcloud pubsub topics publish ${{ secrets.GCLOUD_UPLOADER_PUBSUB_TOPIC }} --message '{"release":"'"${{ github.ref_name }}"'", "latest":true}'