pypi.yml

name: PyPI

on:
  push:
    tags:
      - "v[0-9]*.[0-9]*.[0-9]*"

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  validate-and-publish:
    name: Validate version & publish to PyPI
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write  # required for OIDC trusted publishing

    steps:
      - uses: actions/checkout@v6

      - name: Validate tag is on main
        run: |
          git fetch origin main --depth=1
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            echo "Error: tag $GITHUB_REF_NAME is not on the main branch"
            exit 1
          fi
          echo "Branch check passed: tag is on main"

      - name: Validate tag matches package version
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PKG_VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "Error: tag $GITHUB_REF_NAME does not match package version $PKG_VERSION"
            exit 1
          fi
          echo "Version check passed: $PKG_VERSION"

      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - run: uv sync --frozen

      - name: Build
        run: uv build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1