ci(release): migrate PyPI publishing to OSS Exit Gate

.github/workflows/ci-build.yml

@@ -9,6 +9,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   pytest-job:
     name: "python ${{ matrix.python-version }}"
@@ -19,13 +22,13 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
     - name: Cancel previous
-      uses: styfle/cancel-workflow-action@0.7.0
+      uses: styfle/cancel-workflow-action@d7e57e26a6f753933f8ef746a37097a61375236b # 0.7.0
       with:
         access_token: ${{ github.token }}
       if: ${{github.ref != 'refs/head/main'}}
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install Xarray-Beam
@@ -53,12 +56,45 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
     timeout-minutes: 30
 
     steps:
-    # Publish the package (if local `__version__` > pip version)
-    - uses: etils-actions/pypi-auto-publish@v1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
-        pypi-token: ${{ secrets.PYPI_API_TOKEN }}
-        gh-token: ${{ secrets.GITHUB_TOKEN }}
-        parse-changelog: false
+        python-version: '3.12'
+    - name: Check version and build if new
+      id: check_version
+      run: |
+        python -m pip install --upgrade pip build twine packaging
+        python -m build
+        LOCAL_VER=$(python -c "import glob, os; whl=glob.glob('dist/*.whl')[0]; print(os.path.basename(whl).split('-')[1])")
+        PYPI_VER=$(python -c "import json, urllib.request; print(json.loads(urllib.request.urlopen('https://pypi.org/pypi/xarray-beam/json').read())['info']['version'])")
+        echo "Local: $LOCAL_VER, PyPI: $PYPI_VER"
+        if python -c "from packaging.version import Version; exit(0 if Version('$LOCAL_VER') > Version('$PYPI_VER') else 1)"; then
+          echo "should_publish=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "should_publish=false" >> "$GITHUB_OUTPUT"
+        fi
+    - name: Authenticate to Google Cloud (OSS Exit Gate)
+      if: steps.check_version.outputs.should_publish == 'true'
+      uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed
+      with:
+        workload_identity_provider: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github'
+    - name: Set up Cloud SDK
+      if: steps.check_version.outputs.should_publish == 'true'
+      uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f
+    - name: Stage to OSS Exit Gate and upload manifest
+      if: steps.check_version.outputs.should_publish == 'true'
+      run: |
+        python -m twine upload \
+          --repository-url "https://us-python.pkg.dev/oss-exit-gate-prod/xarray-beam--pypi/" \
+          -u oauth2accesstoken \
+          -p "$(gcloud auth print-access-token)" \
+          dist/*
+        echo '{"publish_all": true}' > manifest.json
+        gcloud storage cp manifest.json \
+          "gs://oss-exit-gate-prod-projects-bucket/xarray-beam/pypi/manifests/manifest-${{ github.run_id }}-${{ github.run_attempt }}.json"