publish.yaml

# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Publish

on:  # yamllint disable-line rule:truthy

  # postsubmit
  push:
    branches:
    - main
    paths:
    - 'tensorflow_federated/version.py'

  # manual
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:

  publish-release:
    name: Publish Release
    # Only if:
    # * Repository is not a fork.
    # * Branch is `main` (for workflow_dispatch trigger).
    if: |
      github.repository == 'google-parfait/tensorflow-federated'
      && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write  # Required to create a release.
    outputs:
      release-tag: v${{ env.version }}
    steps:

    - name: Checkout repository
      uses: actions/checkout@v4.1.7

    - name: Get the latest version
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        latest_version="$(gh release view \
            --json "tagName" \
            --jq ".tagName" \
            | sed "s/^v//")"
        echo "latest_version=${latest_version}" >> $GITHUB_ENV

    - name: Get the version
      run: |
        version="$(sed --quiet \
            "s/^__version__ = '\(.*\)'$/\1/p" \
            "tensorflow_federated/version.py")"
        echo "version=${version}" >> $GITHUB_ENV

    - name: Get the description
      run: |
        description="$(sed --quiet \
            "/^## Release ${{ env.version }}$/,/^## Release /p" \
            "RELEASE.md" \
            | head --lines=-1 \
            | sed "s/^#//")"
        {
          echo "description<<EOF"
          echo "${description}"
          echo "EOF"
        } >> "$GITHUB_ENV"

    - name: Publish release
      if: ${{ env.latest_version != env.version }}
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        gh release create "v${{ env.version }}" \
            --target="${{ github.sha }}" \
            --title="TensorFlow Federated ${{ env.version }}" \
            --notes="$(cat <<'EOF'
        ${{ env.description }}
        EOF
        )"

  build-package:
    name: Build Package
    needs: [publish-release]
    runs-on: ubuntu-20.04
    timeout-minutes: 60
    steps:

    - name: Checkout repository
      uses: actions/checkout@v4.1.7
      with:
        ref: ${{ needs.publish-release.outputs.release-tag }}

    - name: Authenticate to Google Cloud
      id: auth
      uses: google-github-actions/auth@v2.1.3
      with:
        credentials_json: ${{ secrets.GOOGLE_CREDENTIALS }}
        create_credentials_file: true

    - name: Set up bazel repository cache
      uses: actions/cache@v4.0.2
      with:
        path: "~/.cache/bazel/"
        key: ${{ runner.os }}-bazel-${{ hashFiles('.bazelversion', '.bazelrc', 'WORKSPACE') }}
        restore-keys: ${{ runner.os }}-bazel-

    - name: Set up Python
      uses: actions/setup-python@v5.1.0
      with:
        python-version: "3.11"
        cache: "pip"

    - name: Install Python dependencies
      run: |
        pip install --upgrade "pip"

    - name: Build Python package
      run: |
        pip install --upgrade "numpy~=1.25"
        bazelisk run //tools/python_package:build_python_package \
            --build_tag_filters="-nokokoro,-nopresubmit,-requires-gpu-nvidia" \
            --google_credentials="${{ steps.auth.outputs.credentials_file_path }}" \
            --remote_cache="https://storage.googleapis.com/tensorflow-federated-bazel-cache/${{ github.job }}" \
            -- \
            --output_dir="${{ github.workspace }}/dist/"

    - name: Upload Python package
      uses: actions/upload-artifact@v4.3.3
      with:
        name: python-package-distributions
        path: dist/*.whl

  test-package:
    name: Test Package
    needs: [build-package]
    runs-on: ubuntu-20.04
    timeout-minutes: 5
    steps:

    - name: Checkout repository
      uses: actions/checkout@v4.1.7
      with:
        ref: ${{ needs.publish-release.outputs.release-tag }}

    - name: Download Python package
      uses: actions/download-artifact@v4.1.7
      with:
        name: python-package-distributions
        path: dist/

    - name: Set up Python
      uses: actions/setup-python@v5.1.0
      with:
        python-version: "3.11"
        cache: "pip"

    - name: Install Python dependencies
      run: |
        pip install --upgrade "pip"

    - name: Test Python package
      run: |
        package="$(ls "${{ github.workspace }}/dist/"*".whl" | head -n1)"
        actual_size="$(du -b "${package}" | cut -f1)"
        maximum_size=80000000  # 80 MiB
        if [[ "${actual_size}" -ge "${maximum_size}" ]]; then
          echo "error: expected '${package}' to be less than '${maximum_size}' bytes, it was '${actual_size}' bytes" 1>&2
          exit 1
        fi
        pip install --upgrade "${package}"
        python -I -c "import tensorflow_federated as tff; print(tff.federated_computation(lambda: 'Hello World')())"
        python -I -c "import tensorflow_federated as tff; print(tff.__version__)"

  publish-package:
    name: Publish Package
    needs: [build-package, test-package]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      id-token: write  # Required for trusted publishing.
    steps:

    - name: Download Python package
      uses: actions/download-artifact@v4.1.7
      with:
        name: python-package-distributions
        path: dist/

    - name: Publish Python package
      uses: pypa/gh-action-pypi-publish@v1.8.14