_reusable-rc-release-process.yaml

# Release Candidate Process Workflow
#
# This reusable workflow implements a comprehensive release candidate (RC) process
# with multiple validation stages and approvals.
#
# Key Features:
# - Multi-stage validation
# - Technical review process
# - QA validation steps
# - Product review integration
# - Approval tracking
#
# Process Stages:
# 1. Technical Review:
#    - Test PyPI deployment
#    - Build validation
#    - Security verification
#
# 2. QA Validation:
#    - Test results review
#    - Deployment verification
#    - Documentation check
#
# 3. Product Review:
#    - Feature verification
#    - Release notes review
#    - Version compatibility
#
# 4. Final Approval:
#    - Sign-off collection
#    - Approval recording
#    - Release readiness
#
# Required Inputs:
# - version: Version to release
# - artifact-name: Name of build artifact
#
# Note: PyPI publishing uses OIDC (OpenID Connect) authentication.
# Configure trusted publisher in Test PyPI project settings:
# - Owner: <your-org>
# - Repository name: anomalib
# - Workflow name: release.yaml
# - Environment name: technical-review
#
# Example Usage:
# 1. Standard RC Process:
#    jobs:
#      rc-release:
#        uses: ./.github/workflows/_reusable-rc-release-process.yaml
#        with:
#          version: "v1.2.3-rc1"
#          artifact-name: "dist-123456789"
#        secrets:
#          test-pypi-token: ${{ secrets.TEST_PYPI_TOKEN }}
#
# Note: Requires configured environments with appropriate approvals

name: RC Release Process

on:
  workflow_call:
    inputs:
      version:
        required: true
        type: string
      artifact-name:
        required: true
        type: string

permissions:
  contents: read
  id-token: write # Required for OIDC authentication with PyPI

jobs:
  technical-review:
    environment:
      name: technical-review
      url: ${{ steps.review-url.outputs.url }}
    runs-on: ubuntu-latest
    outputs:
      deployment-status: ${{ steps.validate-deployment.outputs.status }}
    steps:
      - name: Generate review URL
        id: review-url
        run: |
          echo "url=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> $GITHUB_OUTPUT

      - name: Download build artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          name: ${{ inputs.artifact-name }}
          path: dist

      - name: Download test results
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          pattern: "*-test-results"
          merge-multiple: true
          path: test-results

      - name: Download security results
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          pattern: "*-security-results"
          merge-multiple: true
          path: security-results

      - name: Download quality results
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          pattern: "*-quality-results"
          merge-multiple: true
          path: quality-results

      - name: Deploy to Test PyPI
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
        with:
          repository-url: https://test.pypi.org/legacy/
          verbose: true

      - name: Validate deployment
        id: validate-deployment
        run: |
          WHEEL_FILE=$(ls dist/*.whl | head -n 1)
          PACKAGE_NAME=$(basename $WHEEL_FILE | cut -d'-' -f1)

          sleep 30

          python -m venv test-env
          source test-env/bin/activate

          pip install --index-url https://test.pypi.org/simple/ \
                     --extra-index-url https://pypi.org/simple \
                     "${PACKAGE_NAME}==${VERSION#v}"

          if python -c "import ${PACKAGE_NAME}"; then
            echo "status=success" >> $GITHUB_OUTPUT
          else
            echo "status=failure" >> $GITHUB_OUTPUT
            exit 1
          fi
        env:
          VERSION: ${{ inputs.version }}
          STEPS_VALIDATE_DEPLOYMENT_OUTPUTS_STATUS: ${{ steps.validate-deployment.outputs.status }}

      - name: Generate technical review report
        env:
          VERSION: ${{ inputs.version }}
        run: |
          cat << EOF > technical-review-report.md
          # Technical Review Report

          ## Version Information
          - Version: "$VERSION"
          - Package Name: $(ls dist/*.whl | head -n 1 | xargs basename)

          ## Test Results
          \`\`\`
          $(cat test-results/*/report.xml || echo "No test results found")
          \`\`\`

          ## Security Scan Results
          \`\`\`
          $(cat security-results/*/report.json || echo "No security results found")
          \`\`\`

          ## Code Quality Results
          \`\`\`
          $(cat quality-results/*/report.txt || echo "No quality results found")
          \`\`\`

          ## Test PyPI Deployment
          - Status: "$STEPS_VALIDATE_DEPLOYMENT_OUTPUTS_STATUS"
          - URL: https://test.pypi.org/project/${PACKAGE_NAME}/${VERSION#v}/

          EOF

      - name: Upload technical review report
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: technical-review-report
          path: technical-review-report.md

  qa-validation:
    needs: [technical-review]
    environment:
      name: qa-validation
      url: ${{ steps.qa-url.outputs.url }}
    runs-on: ubuntu-latest
    steps:
      - name: Generate QA URL
        id: qa-url
        run: |
          echo "url=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> $GITHUB_OUTPUT

      - name: Download technical review report
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          name: technical-review-report
          path: qa-review

      - name: Generate QA dashboard
        env:
          NEEDS_TECHNICAL_REVIEW_OUTPUTS_DEPLOYMENT_STATUS: ${{ needs.technical-review.outputs.deployment-status }}
        run: |
          echo "QA Review Dashboard"
          echo "==================="
          echo
          echo "Technical Review Status: $NEEDS_TECHNICAL_REVIEW_OUTPUTS_DEPLOYMENT_STATUS"
          echo
          echo "Review the full technical report at: qa-review/technical-review-report.md"
          echo
          echo "Please validate the following:"
          echo "1. All tests have passed"
          echo "2. No security issues found"
          echo "3. Code quality meets standards"
          echo "4. Package is installable from Test PyPI"
          echo "5. Documentation is up to date"

  product-review:
    needs: [qa-validation]
    environment:
      name: product-review
    runs-on: ubuntu-latest
    steps:
      - name: Download technical review report
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          name: technical-review-report

      - name: Display release information
        env:
          VERSION: ${{ inputs.version }}
        run: |
          echo "Release Information for $VERSION"
          echo "----------------------------------------"
          cat technical-review-report.md

  release-approval:
    needs: [product-review]
    environment:
      name: release-approval
    runs-on: ubuntu-latest
    steps:
      - name: Record approval
        env:
          APPROVER: ${{ github.actor }}
          VERSION: ${{ inputs.version }}
        run: |
          echo "RC Approval Record:"
          echo "- Version: $VERSION"
          echo "- Timestamp: $(date -u +"%Y-%m-%dT%H:%M:%SZ")"
          echo "- Approver: $APPROVER"