From 57f1aed699a52ecc11bfecd9e620ab1b2f594199 Mon Sep 17 00:00:00 2001 From: Calvin Yau Date: Mon, 6 Jul 2026 18:56:15 -0700 Subject: [PATCH 1/2] fix: bring back pre-Sentry release process workflows --- .craft.yml | 15 --- .github/workflows/broadcast_api_changes.yml | 2 +- .github/workflows/build.yml | 140 -------------------- .github/workflows/build_assets.yml | 129 ++++++++++++++++++ .github/workflows/build_for_pypi.yml | 28 ++++ .github/workflows/ci.yml | 8 +- .github/workflows/create-release.yml | 2 +- .github/workflows/create_release_pr.yml | 54 ++++++++ .github/workflows/release-codecov-cli.yml | 51 ------- .github/workflows/release_flow.yml | 72 ++++++++++ 10 files changed, 289 insertions(+), 212 deletions(-) delete mode 100644 .craft.yml delete mode 100644 .github/workflows/build.yml create mode 100644 .github/workflows/build_assets.yml create mode 100644 .github/workflows/build_for_pypi.yml create mode 100644 .github/workflows/create_release_pr.yml delete mode 100644 .github/workflows/release-codecov-cli.yml create mode 100644 .github/workflows/release_flow.yml diff --git a/.craft.yml b/.craft.yml deleted file mode 100644 index 9025f453..00000000 --- a/.craft.yml +++ /dev/null @@ -1,15 +0,0 @@ -github: - owner: codecov - repo: codecov-cli - -changelogPolicy: auto - -targets: - - name: github - tagPrefix: v - checksums: - - algorithm: sha256 - includeNames: /^(codecov|codecov_)cli.*/i - - - name: pypi - includeNames: /codecov_cli-*/i diff --git a/.github/workflows/broadcast_api_changes.yml b/.github/workflows/broadcast_api_changes.yml index 2a851394..be099e31 100644 --- a/.github/workflows/broadcast_api_changes.yml +++ b/.github/workflows/broadcast_api_changes.yml @@ -16,7 +16,7 @@ jobs: issues: write steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install GitHub CLI uses: dev-hanz-ops/install-gh-cli-action@v0.1.0 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml deleted file mode 100644 index 52dde8d4..00000000 --- a/.github/workflows/build.yml +++ /dev/null @@ -1,140 +0,0 @@ -# This workflow builds codecov-cli on push to a release/* branch. The artifacts -# are later picked up and released by Craft. -name: Build release - -on: - push: - branches: - - "release/**" - -permissions: - contents: read - -jobs: - build_for_pypi: - permissions: - contents: read - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - with: - persist-credentials: false - - - name: Install dependencies - run: pip install uv - - - name: Build codecov-cli sdist and bdist - run: uv build - - - name: Upload codecov-cli artifacts - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: codecov-cli_wheel - path: ./dist/* - - build_assets: - name: Build ${{ matrix.os }} binaries - runs-on: ${{ matrix.os }} - strategy: - fail-fast: true - matrix: - include: - - os: macos-14 - TARGET: macos - CMD_BUILD: > - uv run pyinstaller --target-arch universal2 -F ./codecov_cli/main.py && - mv ./dist/main ./dist/codecovcli_macos - OUT_FILE_SUFFIX: _macos - ASSET_MIME: application/octet-stream - - - os: windows-2022 - TARGET: windows - CMD_BUILD: > - uv run pyinstaller -F .\codecov_cli\main.py && - Move-Item -Path ".\dist\main.exe" -Destination ".\dist\codecovcli_windows.exe" - OUT_FILE_SUFFIX: _windows.exe - ASSET_MIME: application/vnd.microsoft.portable-executable - - steps: - - uses: actions/checkout@v7 - - - name: Set up Python 3.9 - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 - with: - python-version: "3.9" - - - name: Install dependencies - run: | - pip install uv - # Need to build pyyaml and ijson from sdists to get universal2 macos build to work - uv sync --no-binary-package pyyaml --no-binary-package ijson - - - name: Build with pyinstaller for ${{matrix.TARGET}} - run: ${{matrix.CMD_BUILD}} - - - name: Upload codecovcli binary for ${{matrix.TARGET}} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: codecovcli${{matrix.OUT_FILE_SUFFIX}} - path: ./dist/codecovcli${{matrix.OUT_FILE_SUFFIX}} - - build_linux_assets: - name: Build ${{ matrix.distro_name }}_${{ matrix.arch }} binary - runs-on: ${{ matrix.runs-on }} - strategy: - matrix: - include: - - distro: "alpine:3.14" # alpine 3.14 needed for musl 1.2.2/python 3.9 compatibility - arch: arm64 - distro_name: alpine - runs-on: ubuntu-24.04-arm - - distro: "alpine:3.14" - arch: x86_64 - distro_name: alpine - runs-on: ubuntu-24.04 - - distro: "ubuntu:20.04" # ubuntu 20.04 needed for glibc 2.31/python 3.9 compatibility - arch: arm64 - distro_name: linux - runs-on: ubuntu-24.04-arm - - distro: "ubuntu:20.04" - distro_name: linux - arch: x86_64 - runs-on: ubuntu-24.04 - - steps: - - uses: actions/checkout@v7 - - - name: Run in Docker - run: | - docker run \ - --rm \ - -v $(pwd):/${{ github.workspace }} \ - -w ${{ github.workspace }} \ - --platform linux/${{ matrix.arch }} \ - ${{ matrix.distro }} \ - ./scripts/build_${{ matrix.distro_name }}.sh ${{ matrix.distro_name }}_${{ matrix.arch }} - - - name: Upload codecovcli binary for ${{matrix.distro_name}}_${{ matrix.arch}} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: codecovcli_${{ matrix.distro_name }}_${{ matrix.arch }} - path: ./dist/codecovcli_* - - package_artifacts: - # Craft requires one artifact named after the long commit sha of the release. - name: Package assets for Craft - runs-on: ubuntu-latest - needs: [build_for_pypi, build_assets, build_linux_assets] - steps: - - name: Download artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 - with: - pattern: "{codecov-,codecov}cli*" - - - name: Upload release artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: ${{ github.sha }} - path: | - codecovcli* - codecov-cli_wheel/* diff --git a/.github/workflows/build_assets.yml b/.github/workflows/build_assets.yml new file mode 100644 index 00000000..0cab4aed --- /dev/null +++ b/.github/workflows/build_assets.yml @@ -0,0 +1,129 @@ +name: Build Compiled Assets + +on: + workflow_call: + inputs: + release: + type: boolean + default: false + description: "Attach artifacts to a release" + +permissions: + contents: read + +jobs: + build_assets: + name: Build packages - ${{ matrix.os }} + runs-on: ${{ matrix.os }} + permissions: + contents: write # needed for svenstaro/upload-release-action when inputs.release == true + strategy: + fail-fast: true + matrix: + include: + - os: macos-latest + TARGET: macos + CMD_BUILD: > + uv run pyinstaller --target-arch universal2 -F codecov_cli/main.py && + mv dist/main dist/codecovcli_macos && + lipo -archs dist/codecovcli_macos | grep 'x86_64 arm64' + OUT_FILE_NAME: codecovcli_macos + + - os: ubuntu-22.04 + TARGET: ubuntu + CMD_BUILD: > + uv run pyinstaller -F codecov_cli/main.py && + cp ./dist/main ./dist/codecovcli_linux + OUT_FILE_NAME: codecovcli_linux + + - os: windows-latest + TARGET: windows + CMD_BUILD: > + uv run pyinstaller -F .\codecov_cli\main.py && + Copy-Item -Path ".\dist\main.exe" -Destination ".\dist\codecovcli_windows.exe" + OUT_FILE_NAME: codecovcli_windows.exe + + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - name: Set up Python 3.11 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + with: + python-version: "3.11" + + - name: Install uv and dependencies + run: | + pip install uv + # Need to build pyyaml and ijson from sdists to get universal2 macos build to work + uv sync --no-binary-package pyyaml --no-binary-package ijson + + - name: Build with pyinstaller for ${{ matrix.TARGET }} + run: ${{ matrix.CMD_BUILD }} + + - name: Upload a Build Artifact + if: inputs.release == false + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: ${{ matrix.OUT_FILE_NAME }} + path: ./dist/${{ matrix.OUT_FILE_NAME }} + + - name: Upload Release Asset + if: inputs.release == true + uses: svenstaro/upload-release-action@81c65b7cd4de9b2570615ce3aad67a41de5b1a13 # v2.11.2 + with: + repo_token: ${{ secrets.GITHUB_TOKEN }} + file: ./dist/${{ matrix.OUT_FILE_NAME }} + asset_name: ${{ matrix.OUT_FILE_NAME }} + tag: ${{ github.ref }} + overwrite: true + + build_assets_alpine_arm: + name: Build assets - Alpine and ARM + runs-on: ${{ matrix.runs-on }} + permissions: + contents: write # needed for svenstaro/upload-release-action when inputs.release == true + strategy: + matrix: + include: + - distro: "alpine:3.14" + arch: arm64 + distro_name: alpine + runs-on: ubuntu-24.04-arm + - distro: "alpine:3.14" + arch: x86_64 + distro_name: alpine + runs-on: ubuntu-24.04 + - distro: "ubuntu:20.04" + arch: arm64 + distro_name: linux + runs-on: ubuntu-24.04-arm + + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - name: Run in Docker + run: | + docker run \ + --rm \ + -v $(pwd):/${{ github.workspace }} \ + -w ${{ github.workspace }} \ + --platform linux/${{ matrix.arch }} \ + ${{ matrix.distro }} \ + ./scripts/build_${{ matrix.distro_name }}.sh ${{ matrix.distro_name }}_${{ matrix.arch }} + + - name: Upload a Build Artifact + if: inputs.release == false + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: codecovcli_${{ matrix.distro_name }}_${{ matrix.arch }} + path: ./dist/codecovcli_${{ matrix.distro_name }}_${{ matrix.arch }} + + - name: Upload Release Asset + if: inputs.release == true + uses: svenstaro/upload-release-action@81c65b7cd4de9b2570615ce3aad67a41de5b1a13 # v2.11.2 + with: + repo_token: ${{ secrets.GITHUB_TOKEN }} + file: ./dist/codecovcli_${{ matrix.distro_name }}_${{ matrix.arch }} + asset_name: codecovcli_${{ matrix.distro_name }}_${{ matrix.arch }} + tag: ${{ github.ref }} + overwrite: true diff --git a/.github/workflows/build_for_pypi.yml b/.github/workflows/build_for_pypi.yml new file mode 100644 index 00000000..3cb9ed26 --- /dev/null +++ b/.github/workflows/build_for_pypi.yml @@ -0,0 +1,28 @@ +--- +name: Build for PyPi + +on: + workflow_call: + +permissions: + contents: read + +jobs: + build_for_pypi: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + + - name: Install uv + run: pip install uv + + - name: Build sdist and wheel + run: uv build + + - name: Store the distribution packages + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: cibw-codecov-cli + path: ./dist/* diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 27c59988..67ffc011 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,7 +18,7 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Check linting with ruff run: | @@ -27,7 +27,7 @@ jobs: detect-command-change: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Python 3.13 uses: actions/setup-python@v5 @@ -55,7 +55,7 @@ jobs: runs-on: ubuntu-latest if: ${{ !github.event.pull_request.head.repo.fork && github.repository_owner == 'codecov' }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 2 @@ -84,7 +84,7 @@ jobs: python-version: ["3.13", "3.12", "3.11", "3.10", "3.9"] runs-on: ${{matrix.os}} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 2 diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index ee43dcab..0e8a5c9a 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 fetch-tags: true diff --git a/.github/workflows/create_release_pr.yml b/.github/workflows/create_release_pr.yml new file mode 100644 index 00000000..f243d623 --- /dev/null +++ b/.github/workflows/create_release_pr.yml @@ -0,0 +1,54 @@ +name: Create CLI Release PR + +on: + workflow_dispatch: + inputs: + versionName: + description: "Name of version (ie 23.9.5)" + required: true + +permissions: + contents: read + +jobs: + create-release-pr: + name: Create PR + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - name: Import GPG key + id: import-gpg + uses: crazy-max/ghaction-import-gpg@v6 + with: + gpg_private_key: ${{ secrets.RELEASER_GPG_PRIVATE_KEY }} + git_user_signingkey: true + git_commit_gpgsign: true + git_config_global: true + + - name: Create release branch + run: git checkout -b release/${{ github.event.inputs.versionName }} + + - name: Update version and push + id: make-commit + run: | + sed -i 's/version\ =\ "[0-9]\+\.[0-9]\+\.[0-9]\+"/version\ =\ "${{ github.event.inputs.versionName }}"/g' pyproject.toml + git add pyproject.toml + git commit -S --message "Prepare release ${{ github.event.inputs.versionName }}" + echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" + git push origin release/${{ github.event.inputs.versionName }} + + - name: Create pull request into main + uses: thomaseizinger/create-pull-request@1.3.1 + with: + github_token: ${{ secrets.GH_RELEASE_TOKEN }} + head: release/${{ github.event.inputs.versionName }} + base: main + title: Release ${{ github.event.inputs.versionName }} + reviewers: ${{ github.event.issue.user.login }} + body: | + Release PR for ${{ github.event.inputs.versionName }} + I've updated the version name and committed: ${{ steps.make-commit.outputs.commit }}. diff --git a/.github/workflows/release-codecov-cli.yml b/.github/workflows/release-codecov-cli.yml deleted file mode 100644 index b89e7729..00000000 --- a/.github/workflows/release-codecov-cli.yml +++ /dev/null @@ -1,51 +0,0 @@ -# This workflow publishes the codecov-cli assets to PyPI and our GCS bucket -# when a release is created. -name: Build and publish codecov-cli - -on: - release: - types: [published] - -permissions: - contents: read - -jobs: - publish_to_pypi: - permissions: - id-token: write # This is required for OIDC - runs-on: ubuntu-latest - steps: - - name: Download pypi release assets - uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12 - with: - tag: ${{ github.ref_name }} - fileName: codecov_cli-* - out-file-path: dist - - - name: Publish package to PyPi - uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4 - with: - verbose: true - packages-dir: dist - - publish_release: - name: Publish release - runs-on: ubuntu-latest - permissions: - contents: "read" - id-token: "write" - steps: - - id: "auth" - name: "Authenticate to Google Cloud" - uses: "google-github-actions/auth@v1.0.0" - with: - create_credentials_file: "true" - workload_identity_provider: ${{ secrets.CODECOV_GCP_WIDP }} - service_account: ${{ secrets.CODECOV_GCP_WIDSA }} - - # Publish the release tag to a Pub/Sub topic - - name: Publish a message to a Pub/Sub topic - env: - CLOUDSDK_CORE_PROJECT: ${{ secrets.GCLOUD_UPLOADER_PROJECT_ID }} - run: | - gcloud pubsub topics publish ${{ secrets.GCLOUD_UPLOADER_PUBSUB_TOPIC }} --message '{"release":"'"${{ github.ref_name }}"'", "latest":true}' diff --git a/.github/workflows/release_flow.yml b/.github/workflows/release_flow.yml new file mode 100644 index 00000000..8db0a169 --- /dev/null +++ b/.github/workflows/release_flow.yml @@ -0,0 +1,72 @@ +name: Build and Publish CLI Release + +on: + release: + types: + - created + +permissions: + contents: read + +jobs: + build_for_pypi: + permissions: + id-token: write # This is required for requesting the JWT + contents: read # This is required for actions/checkout + uses: ./.github/workflows/build_for_pypi.yml + secrets: inherit + + buildassets: + name: Build packages + uses: ./.github/workflows/build_assets.yml + with: + release: true + secrets: inherit + + publish_to_pypi: + needs: + - build_for_pypi + permissions: + id-token: write # This is required for OIDC + runs-on: ubuntu-latest + environment: + name: pypi + url: https://pypi.org/p/codecov-cli + steps: + - name: Download artifacts + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + with: + path: dist/ + pattern: cibw-* + merge-multiple: true + + - name: List artifacts + run: ls -alR dist/ + + - name: Publish package to PyPi + uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4 + with: + verbose: true + packages-dir: dist/ + + publish_release: + name: Publish release + needs: [buildassets, publish_to_pypi] + runs-on: ubuntu-latest + permissions: + contents: read + id-token: write + steps: + - id: auth + name: Authenticate to Google Cloud + uses: google-github-actions/auth@v1.0.0 + with: + create_credentials_file: true + workload_identity_provider: ${{ secrets.CODECOV_GCP_WIDP }} + service_account: ${{ secrets.CODECOV_GCP_WIDSA }} + + - name: Publish a message to a Pub/Sub topic + env: + CLOUDSDK_CORE_PROJECT: ${{ secrets.GCLOUD_UPLOADER_PROJECT_ID }} + run: | + gcloud pubsub topics publish ${{ secrets.GCLOUD_UPLOADER_PUBSUB_TOPIC }} --message '{"release":"'"${{ github.ref_name }}"'", "latest":true}' From e74b5d8375977a6d83138719bd2f898df6c683e6 Mon Sep 17 00:00:00 2001 From: Calvin Yau Date: Mon, 6 Jul 2026 19:10:13 -0700 Subject: [PATCH 2/2] chore: Add back comment --- .github/workflows/release_flow.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/release_flow.yml b/.github/workflows/release_flow.yml index 8db0a169..8174ce57 100644 --- a/.github/workflows/release_flow.yml +++ b/.github/workflows/release_flow.yml @@ -1,3 +1,6 @@ +# This workflow will install Python dependencies, run tests and lint with a variety of Python versions +# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions + name: Build and Publish CLI Release on: