docs/standards/mcp/templates/drone/python-lib.yaml

---
kind: pipeline
type: docker
name: build-and-publish-pypi

platform:
  os: linux
  arch: arm64

workspace:
  path: /drone/src

steps:
  - name: check-version
    image: curlimages/curl:latest
    environment:
      PIP_REPO_URL:
        from_secret: PIP_REPO_URL
      PIP_USERNAME:
        from_secret: PIP_USERNAME
      PIP_PASSWORD:
        from_secret: PIP_PASSWORD
    commands:
      - PACKAGE_NAME=$(grep -E '^name\s*=' pyproject.toml | head -1 | cut -d'"' -f2)
      - VERSION=$(grep -E '^version\s*=' pyproject.toml | head -1 | cut -d'"' -f2)
      - |
        if [ "$DRONE_TAG" != "$VERSION" ]; then
          echo "Tag '$DRONE_TAG' does not match pyproject version '$VERSION'; refusing to publish."
          exit 1
        fi
      - echo "Checking if $PACKAGE_NAME==$VERSION exists on $PIP_REPO_URL ..."
      - |
        if curl -fsSL -u "$PIP_USERNAME:$PIP_PASSWORD" "$PIP_REPO_URL/simple/$PACKAGE_NAME/" | grep -qE "${PACKAGE_NAME}-${VERSION}(-|\.tar\.gz|\.whl)"; then
          echo "$PACKAGE_NAME==$VERSION already exists; skipping build."
          exit 78
        else
          echo "New version detected: $PACKAGE_NAME==$VERSION"
        fi

  - name: quality-gate
    image: python:3.13-slim
    environment:
      PIP_REPO_URL:
        from_secret: PIP_REPO_URL
      PIP_USERNAME:
        from_secret: PIP_USERNAME
      PIP_PASSWORD:
        from_secret: PIP_PASSWORD
    commands:
      - pip install --upgrade pip build
      - |
        if [ -z "$PIP_REPO_URL" ] || [ -z "$PIP_USERNAME" ] || [ -z "$PIP_PASSWORD" ]; then
          echo "PIP_REPO_URL / PIP_USERNAME / PIP_PASSWORD are not set" >&2
          exit 1
        fi
      - AUTH_URL="https://$PIP_USERNAME:$PIP_PASSWORD@$(echo "$PIP_REPO_URL" | sed -E 's|^[a-zA-Z]+://||; s|/*$||')/simple"
      - pip install --index-url "$AUTH_URL" --extra-index-url https://pypi.org/simple/ -U ".[dev]" "pydoclint>=0.9.1"
      - echo "Running quality gate..."
      - python -m black --check .
      - python -m ruff check .
      - python -m mypy
      - pydoclint .
      - python -m pytest

  - name: build-package
    image: python:3.13-slim
    commands:
      - pip install --upgrade pip build
      - echo "Building Python package..."
      - python -m build
      - ls -l dist

  - name: upload-to-private-pypi
    image: python:3.13-slim
    environment:
      PIP_REPO_URL:
        from_secret: PIP_REPO_URL
      PIP_USERNAME:
        from_secret: PIP_USERNAME
      PIP_PASSWORD:
        from_secret: PIP_PASSWORD
    commands:
      - pip install --upgrade twine
      - echo "Uploading to private PyPI at $PIP_REPO_URL ..."
      - |
        twine upload \
          --repository-url "$PIP_REPO_URL" \
          -u "$PIP_USERNAME" \
          -p "$PIP_PASSWORD" \
          dist/*

trigger:
  event:
    - tag

---
kind: pipeline
type: docker
name: backfill-pypi-from-tags

platform:
  os: linux
  arch: arm64

workspace:
  path: /drone/src

steps:
  - name: fetch-tags
    image: alpine/git
    commands:
      - git fetch --tags --force

  - name: build-and-upload-missing
    image: python:3.13-slim
    environment:
      PIP_REPO_URL:
        from_secret: PIP_REPO_URL
      PIP_USERNAME:
        from_secret: PIP_USERNAME
      PIP_PASSWORD:
        from_secret: PIP_PASSWORD
    commands:
      - apt-get update
      - apt-get install -y git curl ca-certificates
      - pip install --upgrade pip build twine
      - |
        set -e

        PACKAGE_NAME=$(grep -E '^name\s*=' pyproject.toml | cut -d'"' -f2)
        echo "Package: $PACKAGE_NAME"

        for TAG in $(git tag --sort=version:refname); do
          VERSION="$TAG"
          echo "Version: $VERSION"

          if curl -fsSL -u "$PIP_USERNAME:$PIP_PASSWORD" \
            "$PIP_REPO_URL/simple/$PACKAGE_NAME/" | grep -qE "${PACKAGE_NAME}-${VERSION}(-|\.tar\.gz|\.whl)"; then
            echo "Exists, skipping"
            continue
          fi

          git checkout --force "$TAG"

          TAG_VERSION=$(grep -E '^version\s*=' pyproject.toml | head -1 | cut -d'"' -f2)
          if [ "$TAG" != "$TAG_VERSION" ]; then
            echo "Tag $TAG != pyproject version $TAG_VERSION at that commit; skipping"
            continue
          fi

          echo "Building $VERSION"
          rm -rf dist
          python -m build

          echo "Uploading $VERSION"
          twine upload \
            --repository-url "$PIP_REPO_URL" \
            -u "$PIP_USERNAME" \
            -p "$PIP_PASSWORD" \
            dist/*
        done

trigger:
  event:
    - custom