feat: add ci workflow for main, move release workflow to release, onl…

…y publish pypi if version changed

.github/workflows/main.yml

@@ -0,0 +1,11 @@
+name: Main CI Workflow
+on:
+  push:
+    branches:
+      - main
+jobs:
+  setup-and-test:
+    uses: ./.github/workflows/unit-test.yml
+    with:
+      os: ubuntu-latest
+    secrets: inherit

.github/workflows/publish-docker-hub.yml

@@ -22,14 +22,18 @@ jobs:
         with:
           repository: ${{ github.repository }}
           ref: ${{ github.event.pull_request.head.sha }}
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
+
       - name: Build and push Docker images
         run: cd docker && ./release_images.sh

.github/workflows/publish-to-pypi.yml

@@ -1,29 +1,46 @@
+# TODO: switch to a tag-based approach later
 name: Publish PyPI Package
 on:
   workflow_call:
 jobs:
   publish_to_pypi:
     name: Publish Python package to PyPI
     runs-on: ubuntu-latest
-    # Set permissions for trusted publishing.
-    permissions:
-      id-token: write
-      contents: read
     steps:
       - uses: actions/[email protected]
+
       - name: Set up Python
         uses: actions/setup-python@v2
         with:
           python-version: 3.12
+
       - name: Install Poetry
         uses: snok/[email protected]
         with:
           virtualenvs-create: true
           virtualenvs-in-project: true
+
       - name: Build package
         run: poetry build
+
       - name: Build package
         run: poetry build
-      - name: Publish the package with poetry
+
+      - name: Extract version from pyproject.toml
+        id: get_version
         run: |
-          poetry publish -u __token__ -p '${{ secrets.PYPI_API_TOKEN }}'
+          version=$(grep '^version = ' pyproject.toml | sed -E 's/version = "(.*)"/\1/')
+          echo "Package version: $version"
+          echo "::set-output name=VERSION::$version"
+
+      - name: Get the latest published version from PyPI
+        id: get_pypi_version
+        run: |
+          package_name=$(grep '^name = ' pyproject.toml | sed -E 's/name = "(.*)"/\1/')
+          latest_version=$(python -m pip install -U pip && pip search "$package_name" | grep -Eo "$package_name \([0-9]*\.[0-9]*\.[0-9]*\)")
+          echo "Latest version on PyPI: $latest_version"
+          echo "::set-output name=LATEST_VERSION::$latest_version"
+
+      - name: Publish the package with poetry if the version has changed
+        if: steps.get_version.outputs.VERSION != steps.get_pypi_version.outputs.LATEST_VERSION
+        run: poetry publish -u __token__ -p '${{ secrets.PYPI_API_TOKEN }}'

.github/workflows/release.yml

@@ -2,24 +2,21 @@ name: Release Package & Docker Images
 on:
   push:
     branches:
-      - main
-      # - release
+      - release
 jobs:
   setup-and-test:
     uses: ./.github/workflows/unit-test.yml
     with:
       os: ubuntu-latest
     secrets: inherit
+
   publish-python-package:
     if: github.repository == 'Admyral-Security/admyral'
     needs:
       - setup-and-test
     uses: ./.github/workflows/publish-to-pypi.yml
-    # Set permissions for trusted publishing.
-    permissions:
-      id-token: write
-      contents: read
     secrets: inherit
+
   publish-docker-images:
     if: github.repository == 'Admyral-Security/admyral'
     needs:

.github/workflows/unit-test.yml

@@ -22,23 +22,30 @@ jobs:
         with:
           repository: ${{ github.repository }}
           ref: ${{ github.event.pull_request.head.sha }}
+
       - name: Set up Python
         uses: actions/setup-python@v2
         with:
           python-version: 3.12
+
       - name: Install Poetry
         uses: snok/[email protected]
         with:
           virtualenvs-create: true
           virtualenvs-in-project: true
+
       - name: Install dependencies
         run: poetry install
+
       - name: Run linter
         run: poetry run ruff format --check
+
       - name: Run linter
         run: poetry run ruff check
+
       - name: Run unit tests
         run: poetry run pytest tests/
+
   web-unit-test:
     name: Web Unit Tests
     runs-on: ${{ inputs.os }}
@@ -48,22 +55,29 @@ jobs:
         with:
           repository: ${{ github.repository }}
           ref: ${{ github.event.pull_request.head.sha }}
+
       - name: Install Node.js
         uses: actions/setup-node@v2
         with:
           node-version: 18
+
       - name: Setup pnpm
         uses: pnpm/[email protected]
         with:
           version: 9
+
       - name: Install dependencies
         run: cd web && pnpm install
+
       - name: Run linter
         run: cd web && pnpm lint
+
       - name: Run prettier check
         run: cd web && pnpm prettier:check
+
       - name: Run build
         run: cd web && pnpm build
+
       # TODO: activate when tests are available
       # - name: Run unit tests
       #   run: cd web && pnpm test