Deploy bugbug package to PyPI on new tags

.taskcluster.yml

@@ -45,14 +45,14 @@ tasks:
                cd bugbug &&
                git checkout ${head_rev} &&
                pip install -r test-requirements.txt &&
-               flake8"
+               flake8 &&
+               python infra/version_check.py"
         metadata:
           name: bugbug lint
           description: bugbug lint
           owner: ${user}@users.noreply.github.com
           source: ${repository}/raw/${head_rev}/.taskcluster.yml
 
-
       - taskId: {$eval: as_slugid("training_test_task")}
         created: {$fromNow: ''}
         deadline: {$fromNow: '1 hour'}
@@ -76,7 +76,6 @@ tasks:
           owner: ${user}@users.noreply.github.com
           source: ${repository}/raw/${head_rev}/.taskcluster.yml
 
-
       - taskId: {$eval: as_slugid("tests_task")}
         created: {$fromNow: ''}
         deadline: {$fromNow: '1 hour'}
@@ -146,3 +145,38 @@ tasks:
           description: bugbug packaging test
           owner: ${user}@users.noreply.github.com
           source: ${repository}/raw/${head_rev}/.taskcluster.yml
+
+      - $if: 'tasks_for == "github-push" && head_branch[:10] == "refs/tags/"'
+        then:
+          dependencies:
+            - {$eval: as_slugid("lint_task")}
+            - {$eval: as_slugid("training_test_task")}
+            - {$eval: as_slugid("tests_task")}
+            - {$eval: as_slugid("rollback_test_task")}
+            - {$eval: as_slugid("packaging_test_task")}
+          scopes:
+            - secrets:get:project/relman/bugbug/deploy
+          created: {$fromNow: ''}
+          deadline: {$fromNow: '1 hour'}
+          provisionerId: aws-provisioner-v1
+          workerType: github-worker
+          payload:
+            features:
+              taskclusterProxy:
+                true
+            maxRunTime: 3600
+            image: python
+            command:
+              - "/bin/bash"
+              - "-lcx"
+              - "git clone ${repository} &&
+                 cd bugbug &&
+                 git checkout ${head_rev} &&
+                 python setup.py sdist bdist_wheel &&
+                 pip install twine &&
+                 python infra/pypi.py"
+          metadata:
+            name: bugbug PyPI release
+            description: bugbug PyPI release
+            owner: ${user}@users.noreply.github.com
+            source: ${repository}/raw/${head_rev}/.taskcluster.yml

infra/pypi.py

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this file,
+# You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import os
+import subprocess
+
+import requests
+
+r = requests.get(f'{os.environ["TASKCLUSTER_PROXY_URL"]}/secrets/v1/secret/project/relman/bugbug/deploy')
+r.raise_for_status()
+data = r.json()
+
+os.environ['TWINE_USERNAME'] = data['secret']['pypi']['username']
+os.environ['TWINE_PASSWORD'] = data['secret']['pypi']['password']
+
+subprocess.run(['twine', 'upload', 'dist/*'], check=True)

infra/version_check.py

@@ -0,0 +1,14 @@
+# -*- coding: utf-8 -*-
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this file,
+# You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import subprocess
+
+with open('VERSION', 'r') as f:
+    version = f.read().rstrip()
+
+p = subprocess.run(['git', 'describe', '--abbrev=0', '--tags'], check=True, capture_output=True)
+cur_tag = p.stdout.decode('utf-8')[1:].rstrip()
+
+assert version == cur_tag, 'Version in the VERSION file ({version}) should be the same as the current tag ({cur_tag})'