python-release.yml

name: Semantic Release

on:
  workflow_dispatch:
    inputs:
      bump_major:
        required: false
        type: choice
        description: should the major version be incremented
        default: 'false'
        options:
          - true
          - false

jobs:
  release:
    runs-on: ubuntu-latest
    concurrency: release
    permissions:
      id-token: write
      contents: write

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
        token: ${{ secrets.TOKEN }}

    - name: Install poetry
      run: |
        pipx install poetry

    - name: Set up Python 3.11
      uses: actions/setup-python@v4
      with:
        python-version: 3.11
        cache: 'poetry'

    - name: Install dependencies
      run: |
        poetry check
        poetry lock --no-update
        poetry install --verbose

    - name: Python Semantic Major Release
      if: ${{ inputs.bump_major == 'true' }}
      run: |
        git config --global user.name "Lacework Inc."
        git config --global user.email tech-ally@lacework.net
        echo "${{ secrets.GPG_SECRET_KEY }}" | base64 --decode | gpg --import --no-tty --batch --yes
        git config --global user.signingkey ${{ secrets.GPG_SIGNING_KEY }}
        git config commit.gpgsign true
        git config --global tag.gpgSign true
        poetry run semantic-release version --major
        poetry run semantic-release publish
      env:
        GH_TOKEN: ${{secrets.TOKEN}}


    - name: Python Semantic Release
      if: ${{ inputs.bump_major == 'false' }}
      run: |
        git config --global user.name "Lacework Inc."
        git config --global user.email tech-ally@lacework.net
        echo "${{ secrets.GPG_SECRET_KEY }}" | base64 --decode | gpg --import --no-tty --batch --yes
        git config --global user.signingkey ${{ secrets.GPG_SIGNING_KEY }}
        git config commit.gpgsign true
        git config --global tag.gpgSign true
        poetry run semantic-release version
        poetry run semantic-release publish
      env:
        GH_TOKEN: ${{secrets.TOKEN}}


    - name: Publish to PyPi
      run: |
        poetry publish -vvv --username $PYPI_USERNAME --password $PYPI_PASSWORD
      env:
        PYPI_USERNAME: __token__
        PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}