Add a new workflow for building the mobile/library/python whl and uploading to pypi (#44193)

Create a new workflow that runs on manual dispatch that builds and
repairs the mobile/library/python whl and uploads to pypi

Some things that still need work:

The workflow currently only runs on manual dispatch. We could change it
to run when changes are made to the //library/python:envoy_mobile_wheel
target, but the upload to pypi will fail unless the version is bumped in
the BUILD configuration

~~The workflow is currently still configured for test PyPi. We need to
set up an account and credentials for an official PyPi repo and add them
to the repository as a secret~~

---------

Signed-off-by: Jonathan Wu <jtwu@google.com>
Signed-off-by: Jonathan Wu <jonathanwu12@gmail.com>

Author: citrus7

.github/workflows/_load_env.yml

@@ -110,5 +110,5 @@ jobs:
     needs: request
     if: ${{ inputs.cache-docker }}
     with:
-      request: ${{ toJSON(needs.request.outputs) }}
+      caches: ${{ needs.request.outputs.caches }}
       image-tag: ${{ fromJSON(needs.request.outputs.build-image).default }}

.github/workflows/mobile-release.yml

@@ -5,6 +5,16 @@ permissions:
 
 on:
   workflow_dispatch:
+    inputs:
+      job_to_run:
+        description: 'Select the job to run'
+        required: true
+        default: 'all'
+        type: choice
+        options:
+        - all
+        - android
+        - python
   schedule:
   # Mondays at 1pm UTC (8am EST)
   - cron: "0 13 * * 1"
@@ -18,16 +28,18 @@ jobs:
       contents: read
     uses: ./.github/workflows/_load_env.yml
 
-  release:
+  android-release:
     permissions:
+      actions: read
       contents: read
       packages: read
     if: >-
-      ${{
-          github.repository == 'envoyproxy/envoy'
-          && (github.event.schedule
-              || !contains(github.actor, '[bot]'))
-      }}
+      github.repository == 'envoyproxy/envoy'
+      && (github.event.schedule
+             || !contains(github.actor, '[bot]'))
+      && (github.event.inputs.job_to_run == 'all'
+             || github.event.inputs.job_to_run == 'android'
+             || github.event_name == 'schedule')
     needs: env
     uses: ./.github/workflows/_mobile_container_ci.yml
     with:
@@ -76,8 +88,14 @@ jobs:
             //:android_dist
           output: envoy
 
-  deploy:
-    needs: release
+  android-deploy:
+    needs: android-release
+    if: >-
+      always()
+      && (github.event.inputs.job_to_run == 'all'
+             || github.event.inputs.job_to_run == 'android'
+             || github.event_name == 'schedule')
+      && (needs.android-release.result == 'success')
     permissions:
       contents: read
       packages: read
@@ -141,3 +159,81 @@ jobs:
             ${{ matrix.output }}-pom.xml.asc \
             ${{ matrix.output }}-sources.jar.asc \
             ${{ matrix.output }}-javadoc.jar.asc
+
+  python-release:
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    if: >-
+      github.repository == 'envoyproxy/envoy'
+      && (github.event_name == 'workflow_dispatch')
+      && (github.event.inputs.job_to_run == 'all'
+             || github.event.inputs.job_to_run == 'python')
+    needs: env
+    name: Build and Publish Python Wheel
+    uses: ./.github/workflows/_mobile_container_ci.yml
+    with:
+      args: ${{ matrix.args }}
+      container: ${{ fromJSON(needs.env.outputs.build-image).default }}
+      container-output: |
+        "bazel-bin/library/python/": build/
+      request: ${{ needs.env.outputs.request }}
+      steps-post: |
+        - name: Repair wheel
+          run: |
+            mkdir -p /tmp/dist
+            WHEEL_PATH=$(find /tmp/container-output/build -name "*.whl" | head -n 1)
+
+            if [[ -z "$WHEEL_PATH" ]]; then
+                echo "Error: No wheel file found in /tmp/container-output/build"
+                ls -R /tmp/container-output/
+                exit 1
+            fi
+            python3 -m venv envoy_wheel
+            source envoy_wheel/bin/activate
+            pip install patchelf auditwheel
+
+            auditwheel repair "$WHEEL_PATH" --wheel-dir /tmp/dist
+          shell: bash
+      target: ${{ matrix.target }}
+      upload-name: python-wheel
+      upload-path: /tmp/dist/*.whl
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - target: envoy_mobile_wheel
+          args: >-
+            build
+            --config=ci
+            --config=mobile-rbe
+            --config=mobile-release
+            -c opt --strip=always
+            //library/python:envoy_mobile_wheel
+            --//library/python:python_platform="manylinux2014_x86_64"
+
+  python-publish:
+    needs: python-release
+    if: >-
+      always()
+        && (github.event.inputs.job_to_run == 'all'
+               || github.event.inputs.job_to_run == 'python')
+        && (needs.python-release.result == 'success')
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+    environment:
+      name: pypi
+      url: https://pypi.org/p/envoy-mobile
+    steps:
+    - uses: actions/download-artifact@v4
+      with:
+        name: python-wheel
+        path: dist/
+    - name: Publish to PyPi
+      uses: pypa/gh-action-pypi-publish@release/v1