publish.yml

name: Publish to PyPI

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: pypi-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: Build distributions
    runs-on: ubuntu-latest
    outputs:
      stable: ${{ steps.version.outputs.stable }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.11"

      - name: Validate tag matches package version
        id: version
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          package_version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
          if [ "$RELEASE_TAG" != "v$package_version" ]; then
            echo "Tag $RELEASE_TAG does not match package version $package_version."
            exit 1
          fi

          if [[ "$package_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "stable=true" >> "$GITHUB_OUTPUT"
            release_commit="$(git rev-parse "${RELEASE_TAG}^{commit}")"
            if ! git merge-base --is-ancestor "$release_commit" origin/main; then
              echo "Stable release $RELEASE_TAG must point to a commit contained in main." >&2
              exit 1
            fi
          else
            echo "stable=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Install test and build tools
        run: |
          python -m pip install --upgrade -e .
          python -m pip install --upgrade pytest pytest-asyncio build twine

      - name: Run unit tests
        run: python -m pytest tests/ --ignore=tests/test_integration.py -v

      - name: Build distributions
        run: python -m build

      - name: Check distribution metadata
        run: python -m twine check dist/*

      - name: Smoke test wheel
        run: |
          python -m venv /tmp/insforge-wheel-test
          /tmp/insforge-wheel-test/bin/python -m pip install dist/*.whl
          cd /tmp
          /tmp/insforge-wheel-test/bin/python -c 'import insforge; from importlib.metadata import version; print(version("insforge"))'

      - name: Upload distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: python-package-distributions
          path: dist/
          if-no-files-found: error
          retention-days: 1

  publish:
    name: Publish distributions
    needs: build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - name: Download distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: python-package-distributions
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

  release:
    name: Create stable GitHub Release
    if: needs.build.outputs.stable == 'true'
    needs: [build, publish]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
          REPOSITORY: ${{ github.repository }}
        run: |
          if gh release view "$RELEASE_TAG" --repo "$REPOSITORY" >/dev/null 2>&1; then
            echo "GitHub Release $RELEASE_TAG already exists"
          else
            gh release create "$RELEASE_TAG" --repo "$REPOSITORY" --generate-notes --verify-tag
          fi