cloudbuild.yaml

# Cloud Build pipeline triggered on git tag push.
#
# Builds an sdist + wheel for google-colab-cli using `uv build`, then publishes
# both to the OSS Exit Gate Artifact Registry repository:
#   https://us-python.pkg.dev/oss-exit-gate-prod/google-colab-cli--pypi
# and triggers an Exit Gate release by uploading a manifest to:
#   gs://oss-exit-gate-prod-projects-bucket/google-colab-cli/pypi/manifests/
#
# OSS Exit Gate consumes the artifacts from AR and publishes them to PyPI under
# the google-colab-cli project. See go/oss-exit-gate-release-python.
#
# The build runs against the tagged commit (TAG_NAME is set by the trigger).
# Version is derived from the git tag by hatch-vcs, so the checkout must have
# tags available (Cloud Build's default GitHub checkout includes them).
#
# Trigger: GitHub push to refs/tags/v* on googlecolab/google-colab-cli (main).
substitutions:
  _AR_LOCATION: us
  _AR_REPOSITORY: google-colab-cli--pypi
  _AR_PROJECT: oss-exit-gate-prod
  _EG_PROJECT_NAME: google-colab-cli
  _EG_REGISTRY: pypi
  _EG_TRIGGER_BUCKET: oss-exit-gate-prod-projects-bucket

steps:
  # 1. Ensure hatch-vcs sees the tag. Cloud Build's default GitHub checkout
  #    is shallow and may omit tag refs; unshallow + force-fetch tags so
  #    `git describe` returns the clean tag (e.g. v0.5.5 -> 0.5.5) rather
  #    than a dev-suffixed pseudo-version.
  - id: show-version
    name: gcr.io/cloud-builders/git
    entrypoint: bash
    args:
      - -c
      - |
        set -e
        git fetch --tags --force --unshallow 2>/dev/null || git fetch --tags --force
        echo "TAG_NAME=${TAG_NAME}"
        echo "git describe: $(git describe --tags --always)"

  # 1b. Delete any artifacts a previous run left staged.
  #     Staged artifacts are only cleaned up after a successful release; a
  #     failed one leaves them in place so the release can be retried. Since
  #     step 4 publishes with `publish_all: true`, a later release would pick
  #     those up too and republish them alongside the new ones.
  #     This has to run as part of the build, which holds the delete
  #     permission that individual accounts do not.
  #     `|| true` so a first-ever release (nothing to delete) isn't a failure.
  - id: purge-stale-artifacts
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: bash
    args:
      - -c
      - |
        set -e
        gcloud artifacts versions delete ${TAG_NAME}  \
          --package={_EG_PROJECT_NAME} \
          --project={_AR_PROJECT} \
          --repository=${_AR_REPOSITORY} \
          --location=us \
          --quiet || true

  # 2. Build sdist + wheel into dist/ using uv.
  #    Use the non-slim bookworm variant: hatch-vcs derives the version
  #    by shelling out to `git describe`, which requires a git binary
  #    in the build container. The -slim variant omits git and breaks
  #    the build with a setuptools-scm "not a git repository" error.
  - id: build
    name: ghcr.io/astral-sh/uv:python3.13-bookworm
    entrypoint: bash
    args:
      - -c
      - |
        set -e
        uv build
        ls -la dist/

  # 3. Publish artifacts to the OSS Exit Gate AR repository via twine + the
  #    google-artifactregistry-auth keyring plugin (uses ADC from the
  #    Cloud Build service account, which is registered as a builder in
  #    the project's project.txtpb).
  #    Delete any existing artifact for this tag which can happen if the
  #    build failed to publish in step 4.
  - id: publish-to-ar
    name: python:3.13-slim
    entrypoint: bash
    args:
      - -c
      - |
        set -e
        pip install --quiet --root-user-action=ignore \
          twine keyrings.google-artifactregistry-auth
        twine upload \
          --repository-url "https://${_AR_LOCATION}-python.pkg.dev/${_AR_PROJECT}/${_AR_REPOSITORY}/" \
          --verbose \
          dist/*

  # 4. Trigger the OSS Exit Gate release by uploading a manifest file to the
  #    project's GCS trigger bucket. `publish_all: true` tells the Exit Gate to
  #    publish every artifact currently in our AR repo, which is correct here
  #    because the trigger fires on a single tag push and only the artifacts
  #    for that tag are in AR at this moment (Exit Gate auto-cleans on success).
  #
  #    Note: this step runs in the same Cloud Build as the AR upload. This is
  #    fine for BCID L0 (no attestations). When/if we move to BCID L1+ this
  #    must be split into a separate build that fires after this one succeeds;
  #    see go/oss-exit-gate-faq#why-manifest.
  - id: trigger-release
    name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
    entrypoint: bash
    args:
      - -c
      - |
        set -e
        MANIFEST="${_EG_PROJECT_NAME}-${TAG_NAME}.json"
        echo '{"publish_all": true}' > "$${MANIFEST}"
        echo "Manifest contents:"
        cat "$${MANIFEST}"
        gcloud storage cp "$${MANIFEST}" \
          "gs://${_EG_TRIGGER_BUCKET}/${_EG_PROJECT_NAME}/${_EG_REGISTRY}/manifests/$${MANIFEST}"

# Surface the built artifacts in the Cloud Build UI / logs.
artifacts:
  objects:
    location: gs://${PROJECT_ID}_cloudbuild/google-colab-cli/${TAG_NAME}
    paths:
      - dist/*

options:
  logging: CLOUD_LOGGING_ONLY