aetos/doc-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci(drone): adopt standard PyPI pipeline with tag==version guard

Browse Source 
Replace .drone.yml with the canonical Type A template: the tag build now fails unless the git tag equals the pyproject.toml version (both in the publish pipeline and the backfill replay), preventing a tag from silently publishing nothing. Also drops the emoji log decorations to match the standard.
This commit is contained in:
Vishesh 'ironeagle' Bangotra
2026-10-15 18:50:44 +05:30
parent 18420ac579
commit ac97f08527
1 changed files with 40 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
.drone.yml
View File

@@ -1,3 +1,21 @@
# Drone standard — Type A: PyPI package
#
# Canonical pipeline for internal Python libraries that ship a wheel/sdist to
# the private index (dagpipe, doc-forge, hexa, mail-intake, mongo-ops,
# omniread, openapi-first, py-jwt).
#
# Two pipelines ship together:
# build-and-publish-pypi — tag-triggered build + quality gate + publish.
# backfill-pypi-from-tags — custom-triggered replay of every git tag that is
# missing from the index (disaster recovery).
#
# Secrets (Drone): PIP_REPO_URL, PIP_USERNAME, PIP_PASSWORD.
# Copy to <repo>/.drone.yml unchanged; the package name and version are read
# from pyproject.toml, so no per-repo edits are required.
#
# Version guard: the tag build fails unless the git tag equals the version in
# pyproject.toml (see the versioning standard). This stops a tag from looking
# like a release while silently publishing nothing.
--- ---
kind: pipeline kind: pipeline
type: docker type: docker
@@ -23,13 +41,18 @@ steps:
commands: commands:
- PACKAGE_NAME=$(grep -E '^name\s*=' pyproject.toml | head -1 | cut -d'"' -f2) - PACKAGE_NAME=$(grep -E '^name\s*=' pyproject.toml | head -1 | cut -d'"' -f2)
- VERSION=$(grep -E '^version\s*=' pyproject.toml | head -1 | cut -d'"' -f2) - VERSION=$(grep -E '^version\s*=' pyproject.toml | head -1 | cut -d'"' -f2)
- echo "🔍 Checking if $PACKAGE_NAME==$VERSION exists on $PIP_REPO_URL ..." - |
if [ "$DRONE_TAG" != "$VERSION" ]; then
echo "Tag '$DRONE_TAG' does not match pyproject version '$VERSION'; refusing to publish."
exit 1
fi
- echo "Checking if $PACKAGE_NAME==$VERSION exists on $PIP_REPO_URL ..."
- | - |
if curl -fsSL -u "$PIP_USERNAME:$PIP_PASSWORD" "$PIP_REPO_URL/simple/$PACKAGE_NAME/" | grep -qE "${PACKAGE_NAME}-${VERSION}(-|\.tar\.gz|\.whl)"; then if curl -fsSL -u "$PIP_USERNAME:$PIP_PASSWORD" "$PIP_REPO_URL/simple/$PACKAGE_NAME/" | grep -qE "${PACKAGE_NAME}-${VERSION}(-|\.tar\.gz|\.whl)"; then
echo "✅ $PACKAGE_NAME==$VERSION already exists — skipping build." echo "$PACKAGE_NAME==$VERSION already exists; skipping build."
exit 78 exit 78
else else
echo "🆕 New version detected: $PACKAGE_NAME==$VERSION" echo "New version detected: $PACKAGE_NAME==$VERSION"
fi fi
- name: quality-gate - name: quality-gate
@@ -46,7 +69,7 @@ steps:
- | - |
AUTH_URL="https://${PIP_USERNAME}:${PIP_PASSWORD}@$(echo "${PIP_REPO_URL#*://}" | sed 's:/*$::')/simple" AUTH_URL="https://${PIP_USERNAME}:${PIP_PASSWORD}@$(echo "${PIP_REPO_URL#*://}" | sed 's:/*$::')/simple"
pip install --index-url "$AUTH_URL" --extra-index-url https://pypi.org/simple/ -U ".[dev]" "pydoclint>=0.9.1" pip install --index-url "$AUTH_URL" --extra-index-url https://pypi.org/simple/ -U ".[dev]" "pydoclint>=0.9.1"
- echo "🛡️ Running quality gate..." - echo "Running quality gate..."
- python -m black --check . - python -m black --check .
- python -m ruff check . - python -m ruff check .
- python -m mypy - python -m mypy
@@ -57,7 +80,7 @@ steps:
image: python:3.13-slim image: python:3.13-slim
commands: commands:
- pip install --upgrade pip build - pip install --upgrade pip build
- echo "📦 Building Python package..." - echo "Building Python package..."
- python -m build - python -m build
- ls -l dist - ls -l dist
@@ -72,7 +95,7 @@ steps:
from_secret: PIP_PASSWORD from_secret: PIP_PASSWORD
commands: commands:
- pip install --upgrade twine - pip install --upgrade twine
- echo "🚀 Uploading to private PyPI at $PIP_REPO_URL ..." - echo "Uploading to private PyPI at $PIP_REPO_URL ..."
- | - |
twine upload \ twine upload \
--repository-url "$PIP_REPO_URL" \ --repository-url "$PIP_REPO_URL" \
@@ -119,25 +142,31 @@ steps:
set -e set -e
PACKAGE_NAME=$(grep -E '^name\s*=' pyproject.toml | cut -d'"' -f2) PACKAGE_NAME=$(grep -E '^name\s*=' pyproject.toml | cut -d'"' -f2)
echo "📦 Package: $PACKAGE_NAME" echo "Package: $PACKAGE_NAME"
for TAG in $(git tag --sort=version:refname); do for TAG in $(git tag --sort=version:refname); do
VERSION="$TAG" VERSION="$TAG"
echo "🔁 Version: $VERSION" echo "Version: $VERSION"
if curl -fsSL -u "$PIP_USERNAME:$PIP_PASSWORD" \ if curl -fsSL -u "$PIP_USERNAME:$PIP_PASSWORD" \
"$PIP_REPO_URL/simple/$PACKAGE_NAME/" | grep -qE "${PACKAGE_NAME}-${VERSION}(-|\.tar\.gz|\.whl)"; then "$PIP_REPO_URL/simple/$PACKAGE_NAME/" | grep -qE "${PACKAGE_NAME}-${VERSION}(-|\.tar\.gz|\.whl)"; then
echo "⏭️ Exists, skipping" echo "Exists, skipping"
continue continue
fi fi
git checkout --force "$TAG" git checkout --force "$TAG"
echo "🏗️ Building $VERSION" TAG_VERSION=$(grep -E '^version\s*=' pyproject.toml | head -1 | cut -d'"' -f2)
if [ "$TAG" != "$TAG_VERSION" ]; then
echo "Tag $TAG != pyproject version $TAG_VERSION at that commit; skipping"
continue
fi
echo "Building $VERSION"
rm -rf dist rm -rf dist
python -m build python -m build
echo "⬆️ Uploading $VERSION" echo "Uploading $VERSION"
twine upload \ twine upload \
--repository-url "$PIP_REPO_URL" \ --repository-url "$PIP_REPO_URL" \
-u "$PIP_USERNAME" \ -u "$PIP_USERNAME" \