chore: Making the separation between staging and publishing explicit

.github/scripts/publish_preflight_check.sh

@@ -60,6 +60,41 @@ echo_info "Extracted release version: ${RELEASE_VERSION}"
 echo "::set-output name=version::v${RELEASE_VERSION}"
 
 
+echo_info ""
+echo_info "--------------------------------------------"
+echo_info "Check release artifacts"
+echo_info "--------------------------------------------"
+echo_info ""
+
+if [[ ! -d dist ]]; then
+  echo_warn "dist directory does not exist."
+  terminate
+fi
+
+readonly BIN_DIST="dist/firebase_admin-${RELEASE_VERSION}-py3-none-any.whl"
+if [[ -f "${BIN_DIST}" ]]; then
+  echo_info "Found binary distribution (bdist_wheel): ${BIN_DIST}"
+else
+  echo_warn "Binary distribution ${BIN_DIST} not found."
+  terminate
+fi
+
+readonly SRC_DIST="dist/firebase_admin-${RELEASE_VERSION}.tar.gz"
+if [[ -f "${SRC_DIST}" ]]; then
+  echo_info "Found source distribution (sdist): ${SRC_DIST}"
+else
+  echo_warn "Source distribution ${SRC_DIST} not found."
+  terminate
+fi
+
+readonly ARTIFACT_COUNT=`ls dist/ | wc -l`
+if [[ $ARTIFACT_COUNT -ne 2 ]]; then
+  echo_warn "Unexpected artifacts in the distribution directory."
+  ls -l dist
+  terminate
+fi
+
+
 echo_info ""
 echo_info "--------------------------------------------"
 echo_info "Checking previous releases"

.github/workflows/release.yml

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-name: Release
+name: Release Candidate
 
 on:
   # Only run the workflow when a PR is updated or when a developer explicitly requests
@@ -49,7 +49,7 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         pip install -r requirements.txt
-        pip install wheel
+        pip install setuptools wheel
 
     - name: Run unit tests
       run: pytest
@@ -60,8 +60,9 @@ jobs:
         FIREBASE_SERVICE_ACCT_KEY: ${{ secrets.FIREBASE_SERVICE_ACCT_KEY }}
         FIREBASE_API_KEY: ${{ secrets.FIREBASE_API_KEY }}
 
+    # Build the Python Wheel and the source distribution.
     - name: Package release artifacts
-      run: python setup.py bdist_wheel bdist_egg
+      run: python setup.py bdist_wheel sdist
 
     # Attach the packaged artifacts to the workflow output. These can be manually
     # downloaded for later inspection if necessary.
@@ -71,24 +72,48 @@ jobs:
         name: dist
         path: dist
 
+  publish_release:
+    needs: stage_release
+
     # Check whether the release should be published. We publish only when the trigger PR is
     #   1. merged
     #   2. to the master branch
     #   3. with the title prefix '[chore] Release '.
+    if: github.event.pull_request.merged &&
+      github.ref == 'master' &&
+      startsWith(github.event.pull_request.title, '[chore] Release ')
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout source for publish
+      uses: actions/checkout@v2
+
+    # Download the artifacts created by the stage_release job.
+    - name: Download release candidates
+      uses: actions/download-artifact@v1
+      with:
+        name: dist
+
+    # Python is needed to run Twine and some of the preflight checks.
+    - name: Set up Python
+      uses: actions/setup-python@v1
+      with:
+        python-version: 3.6
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install twine
+
     - name: Publish preflight check
-      if: success() && github.event.pull_request.merged &&
-        github.ref == 'master' &&
-        startsWith(github.event.pull_request.title, '[chore] Release ')
       id: preflight
-      run: |
-        ./.github/scripts/publish_preflight_check.sh
-        echo ::set-env name=FIREBASE_PUBLISH::true
+      run: ./.github/scripts/publish_preflight_check.sh
 
-    # Tag the release if not executing in the dryrun mode. We pull this action froma
-    # custom fork of a contributor until https://github.com/actions/create-release/pull/32
-    # is merged. Also note that v1 of this action does not support the "body" parameter.
+    # We pull this action from a custom fork of a contributor until
+    # https://github.com/actions/create-release/pull/32 is merged. Also note that v1 of
+    # this action does not support the "body" parameter.
     - name: Create release tag
-      if: success() && env.FIREBASE_PUBLISH
       uses: fleskesvor/create-release@1a72e235c178bf2ae6c51a8ae36febc24568c5fe
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -100,12 +125,11 @@ jobs:
         prerelease: false
 
     - name: Publish to Pypi
-      if: success() && env.FIREBASE_PUBLISH
       run: echo Publishing to Pypi
 
     # Post to Twitter if explicitly opted-in by adding the label 'release:tweet'.
     - name: Post to Twitter
-      if: success() && env.FIREBASE_PUBLISH &&
+      if: success() &&
         contains(github.event.pull_request.labels.*.name, 'release:tweet')
       run: echo Posting Tweet
       continue-on-error: true