ci: selective signing and automatic release builds (#3430)

Signed-off-by: Jared Van Bortel <jared@nomic.ai>

.circleci/continue_config.yml

@@ -22,10 +22,17 @@ jobs:
   # work around CircleCI-Public/path-filtering-orb#20
   noop:
     docker:
-      - image: cimg/base:current
+      - image: cimg/base:stable
     steps:
       - run: "true"
-
+  validate-commit-on-main:
+    docker:
+      - image: cimg/base:stable
+    steps:
+      - checkout
+      - run:
+          name: Verify that commit is on the main branch
+          command: git merge-base --is-ancestor HEAD main
   build-offline-chat-installer-macos:
     macos:
       xcode: 15.4.0
@@ -1220,7 +1227,7 @@ jobs:
             cd gpt4all-bindings/typescript
             npm run docs:build
 
-  build-py-docs:
+  deploy-docs:
     docker:
       - image: circleci/python:3.8
     steps:
@@ -1424,7 +1431,7 @@ jobs:
           paths:
             - "*.whl"
 
-  publish-wheels:
+  deploy-wheels:
     docker:
       - image: circleci/python:3.8
     steps:
@@ -1721,7 +1728,7 @@ jobs:
             - prebuilds/win32-x64/*.node
             - runtimes/win32-x64/*-*.dll
 
-  prepare-npm-pkg:
+  deploy-npm-pkg:
     docker:
       - image: cimg/base:stable
     steps:
@@ -1777,11 +1784,19 @@ jobs:
             npm set //registry.npmjs.org/:_authToken=$NPM_TOKEN
             npm publish
 
-main_only: &main_only
+# only run a job on the main branch
+job_only_main: &job_only_main
   filters:
     branches:
       only: main
 
+# allow a job to run on tags as well as commits
+job_allow_tags: &job_allow_tags
+  filters:
+    tags:
+      only:
+        - /.*/
+
 workflows:
   version: 2
   noop:
@@ -1794,21 +1809,112 @@ workflows:
           - << pipeline.parameters.run-chat-workflow >>
     jobs:
       - noop
+  build-chat-installers-release:
+    # only run on main branch tags that start with 'v' and a digit
+    when:
+      and:
+        - equal: [ << pipeline.git.branch >>, main ]
+        - matches: { pattern: '^v\d.*', value: << pipeline.git.tag >> }
+    jobs:
+      - validate-commit-on-main
+      - build-offline-chat-installer-macos:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - validate-commit-on-main
+      - sign-offline-chat-installer-macos:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - build-offline-chat-installer-macos
+      - notarize-offline-chat-installer-macos:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - sign-offline-chat-installer-macos
+      - build-offline-chat-installer-windows:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - validate-commit-on-main
+      - sign-offline-chat-installer-windows:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - build-offline-chat-installer-windows
+      - build-offline-chat-installer-windows-arm:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - validate-commit-on-main
+      - sign-offline-chat-installer-windows-arm:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - build-offline-chat-installer-windows-arm
+      - build-offline-chat-installer-linux:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - validate-commit-on-main
+      - build-online-chat-installer-macos:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - validate-commit-on-main
+      - sign-online-chat-installer-macos:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - build-online-chat-installer-macos
+      - notarize-online-chat-installer-macos:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - sign-online-chat-installer-macos
+      - build-online-chat-installer-windows:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - validate-commit-on-main
+      - sign-online-chat-installer-windows:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - build-online-chat-installer-windows
+      - build-online-chat-installer-windows-arm:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - validate-commit-on-main
+      - sign-online-chat-installer-windows-arm:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - build-online-chat-installer-windows-arm
+      - build-online-chat-installer-linux:
+          <<: *job_allow_tags
+          context: gpt4all
+          requires:
+            - validate-commit-on-main
   build-chat-offline-installers:
     when:
       or:
         - << pipeline.parameters.run-all-workflows >>
         - << pipeline.parameters.run-chat-workflow >>
     jobs:
-      - hold:
+      - build-hold:
+          type: approval
+      - sign-hold:
           type: approval
       - build-offline-chat-installer-macos:
           context: gpt4all
           requires:
-            - hold
+            - build-hold
       - sign-offline-chat-installer-macos:
           context: gpt4all
           requires:
+            - sign-hold
             - build-offline-chat-installer-macos
       - notarize-offline-chat-installer-macos:
           context: gpt4all
@@ -1817,15 +1923,16 @@ workflows:
       - build-offline-chat-installer-windows:
           context: gpt4all
           requires:
-            - hold
+            - build-hold
       - sign-offline-chat-installer-windows:
           context: gpt4all
           requires:
+            - sign-hold
             - build-offline-chat-installer-windows
       - build-offline-chat-installer-windows-arm:
           context: gpt4all
           requires:
-            - hold
+            - build-hold
       - sign-offline-chat-installer-windows-arm:
           context: gpt4all
           requires:
@@ -1833,56 +1940,51 @@ workflows:
       - build-offline-chat-installer-linux:
           context: gpt4all
           requires:
-            - hold
+            - build-hold
   build-chat-online-installers:
     when:
       or:
         - << pipeline.parameters.run-all-workflows >>
         - << pipeline.parameters.run-chat-workflow >>
     jobs:
-      - hold:
+      - build-hold:
-          <<: *main_only
+          type: approval
+      - sign-hold:
           type: approval
       - build-online-chat-installer-macos:
-          <<: *main_only
           context: gpt4all
           requires:
-            - hold
+            - build-hold
       - sign-online-chat-installer-macos:
-          <<: *main_only
           context: gpt4all
           requires:
+            - sign-hold
             - build-online-chat-installer-macos
       - notarize-online-chat-installer-macos:
-          <<: *main_only
           context: gpt4all
           requires:
             - sign-online-chat-installer-macos
       - build-online-chat-installer-windows:
-          <<: *main_only
           context: gpt4all
           requires:
-            - hold
+            - build-hold
       - sign-online-chat-installer-windows:
-          <<: *main_only
           context: gpt4all
           requires:
+            - sign-hold
             - build-online-chat-installer-windows
       - build-online-chat-installer-windows-arm:
-          <<: *main_only
           context: gpt4all
           requires:
-            - hold
+            - build-hold
       - sign-online-chat-installer-windows-arm:
-          <<: *main_only
           context: gpt4all
           requires:
             - build-online-chat-installer-windows-arm
       - build-online-chat-installer-linux:
-          <<: *main_only
           context: gpt4all
           requires:
-            - hold
+            - build-hold
   build-and-test-gpt4all-chat:
     when:
       or:
@@ -1905,14 +2007,13 @@ workflows:
             - hold
   deploy-docs:
     when:
-      or:
+      and:
-        - << pipeline.parameters.run-all-workflows >>
+        - equal: [ << pipeline.git.branch >>, main ]
-        - << pipeline.parameters.run-python-workflow >>
+        - or:
+            - << pipeline.parameters.run-all-workflows >>
+            - << pipeline.parameters.run-python-workflow >>
     jobs:
-      - build-ts-docs:
+      - deploy-docs:
-          <<: *main_only
-      - build-py-docs:
-          <<: *main_only
           context: gpt4all
   build-python:
     when:
@@ -1921,7 +2022,7 @@ workflows:
         - << pipeline.parameters.run-python-workflow >>
     jobs:
       - pypi-hold:
-          <<: *main_only
+          <<: *job_only_main
           type: approval
       - hold:
           type: approval
@@ -1934,8 +2035,8 @@ workflows:
       - build-py-windows:
           requires:
             - hold
-      - publish-wheels:
+      - deploy-wheels:
-          <<: *main_only
+          <<: *job_only_main
           context: gpt4all
           requires:
             - pypi-hold
@@ -1946,34 +2047,26 @@ workflows:
     when:
       or:
        - << pipeline.parameters.run-all-workflows >>
-       - << pipeline.parameters.run-python-workflow >>
        - << pipeline.parameters.run-ts-workflow >>
     jobs:
-      - hold:
+      - backend-hold:
           type: approval
       - nodejs-hold:
           type: approval
       - npm-hold:
-          <<: *main_only
+          <<: *job_only_main
+          type: approval
+      - docs-hold:
           type: approval
       - build-bindings-backend-linux:
           requires:
-            - hold
+            - backend-hold
       - build-bindings-backend-macos:
           requires:
-            - hold
+            - backend-hold
       - build-bindings-backend-windows:
           requires:
-            - hold
+            - backend-hold
-
-      # NodeJs Jobs
-      - prepare-npm-pkg:
-          <<: *main_only
-          requires:
-            - npm-hold
-            - build-nodejs-linux
-            - build-nodejs-windows
-            - build-nodejs-macos
       - build-nodejs-linux:
           requires:
             - nodejs-hold
@@ -1986,3 +2079,13 @@ workflows:
           requires:
             - nodejs-hold
             - build-bindings-backend-macos
+      - build-ts-docs:
+          requires:
+            - docs-hold
+      - deploy-npm-pkg:
+          <<: *job_only_main
+          requires:
+            - npm-hold
+            - build-nodejs-linux
+            - build-nodejs-windows
+            - build-nodejs-macos