prowler/.github/workflows/sdk-pypi-release.yml

name: 'SDK: PyPI Release'

on:
  release:
    types:
      - 'published'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
  cancel-in-progress: false

env:
  RELEASE_TAG: ${{ github.event.release.tag_name }}
  PYTHON_VERSION: '3.12'

permissions: {}

jobs:
  validate-release:
    if: github.repository == 'prowler-cloud/prowler'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    outputs:
      prowler_version: ${{ steps.parse-version.outputs.version }}
      major_version: ${{ steps.parse-version.outputs.major }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Parse and validate version
        id: parse-version
        run: |
          PROWLER_VERSION="${RELEASE_TAG}"
          echo "version=${PROWLER_VERSION}" >> "${GITHUB_OUTPUT}"

          # Extract major version
          MAJOR_VERSION="${PROWLER_VERSION%%.*}"
          echo "major=${MAJOR_VERSION}" >> "${GITHUB_OUTPUT}"

          # Validate major version
          case ${MAJOR_VERSION} in
            3|4|5)
              echo "✓ Releasing Prowler v${MAJOR_VERSION} with tag ${PROWLER_VERSION}"
              ;;
            *)
              echo "::error::Unsupported Prowler major version: ${MAJOR_VERSION}"
              exit 1
              ;;
          esac

  publish-prowler:
    needs: validate-release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write
    environment:
      name: pypi-prowler
      url: https://pypi.org/project/prowler/${{ needs.validate-release.outputs.prowler_version }}/

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup Python with uv
        uses: ./.github/actions/setup-python-uv
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          install-dependencies: 'false'

      - name: Build Prowler package
        run: uv build

      - name: Verify the wheel installs with pip
        # Same check as "SDK: Package Checks", repeated on the exact artifact about to be
        # published. Plain pip, --isolated, from outside the repo: an unsatisfiable
        # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one).
        run: |
          python -m venv "${RUNNER_TEMP}/consumer"
          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
          cd "${RUNNER_TEMP}"
          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl

      - name: Publish Prowler package to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          print-hash: true

  publish-prowler-cloud:
    needs: validate-release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write
    environment:
      name: pypi-prowler-cloud
      url: https://pypi.org/project/prowler-cloud/${{ needs.validate-release.outputs.prowler_version }}/

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup Python with uv
        uses: ./.github/actions/setup-python-uv
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          install-dependencies: 'false'

      - name: Install toml package
        run: pip install toml

      - name: Replicate PyPI package for prowler-cloud
        run: |
          rm -rf ./dist ./build prowler.egg-info
          python util/replicate_pypi_package.py

      - name: Build prowler-cloud package
        run: uv build

      - name: Verify the wheel installs with pip
        # Same check as "SDK: Package Checks", repeated on the exact artifact about to be
        # published. Plain pip, --isolated, from outside the repo: an unsatisfiable
        # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one).
        run: |
          python -m venv "${RUNNER_TEMP}/consumer"
          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
          cd "${RUNNER_TEMP}"
          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl

      - name: Publish prowler-cloud package to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          print-hash: true