release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g., v1.0.0)'
        required: true
        type: string

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.11'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install -r requirements-test.txt

    - name: Run tests
      run: python -m pytest

  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.11'

    - name: Install build dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build twine

    - name: Build package
      run: python -m build

    - name: Check package
      run: twine check dist/*

    - name: Upload build artifacts
      uses: actions/upload-artifact@v7
      with:
        name: dist
        path: dist/

  create-release:
    needs: [test, build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0

    - name: Download build artifacts
      uses: actions/download-artifact@v8
      with:
        name: dist
        path: dist/

    - name: Get version
      id: version
      run: |
        if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
          echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
        else
          echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
        fi

    - name: Generate changelog
      id: changelog
      uses: mikepenz/release-changelog-builder-action@v6
      with:
        configuration: |
          {
            "categories": [
              {
                "title": "## 🚀 Features",
                "labels": ["feature", "enhancement"]
              },
              {
                "title": "## 🐛 Bug Fixes",
                "labels": ["bug", "fix"]
              },
              {
                "title": "## 🔧 Maintenance",
                "labels": ["chore", "ci", "deps"]
              },
              {
                "title": "## 📚 Documentation",
                "labels": ["docs", "documentation"]
              }
            ],
            "template": "#{{CHANGELOG}}\n\n## Other Changes\n#{{UNCATEGORIZED}}",
            "pr_template": "- #{{TITLE}} (#{{NUMBER}})",
            "empty_template": "- No changes in this release",
            "transformers": [
              {
                "pattern": "^(feat|feature)(\\(.+\\))?!?:",
                "target": "🚀 $1"
              },
              {
                "pattern": "^(fix|bug)(\\(.+\\))?!?:",
                "target": "🐛 $1"
              },
              {
                "pattern": "^(chore|ci|deps)(\\(.+\\))?!?:",
                "target": "🔧 $1"
              }
            ]
          }
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Create GitHub Release
      uses: softprops/action-gh-release@v3
      with:
        tag_name: ${{ steps.version.outputs.version }}
        name: Release ${{ steps.version.outputs.version }}
        body: ${{ steps.changelog.outputs.changelog }}
        files: |
          dist/*
        draft: false
        prerelease: ${{ contains(steps.version.outputs.version, '-') }}
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-pypi:
    needs: [test, build, create-release]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-')
    environment:
      name: pypi
      url: https://pypi.org/p/gitsafe-cli
    permissions:
      id-token: write
    steps:
    - name: Download build artifacts
      uses: actions/download-artifact@v8
      with:
        name: dist
        path: dist/

    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1

  publish-test-pypi:
    needs: [test, build]
    runs-on: ubuntu-latest
    if: contains(github.ref, '-') || github.event_name == 'workflow_dispatch'
    environment:
      name: testpypi
      url: https://test.pypi.org/p/gitsafe-cli
    permissions:
      id-token: write
    steps:
    - name: Download build artifacts
      uses: actions/download-artifact@v8
      with:
        name: dist
        path: dist/

    - name: Publish to Test PyPI
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        repository-url: https://test.pypi.org/legacy/

  docker:
    needs: [test, build]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
    - uses: actions/checkout@v6

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v4

    - name: Login to Docker Hub
      uses: docker/login-action@v4
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v6
      with:
        images: ${{ secrets.DOCKER_USERNAME }}/git-safe
        tags: |
          type=ref,event=tag
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}

    - name: Build and push Docker image
      uses: docker/build-push-action@v7
      with:
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        platforms: linux/amd64,linux/arm64

    - name: Update Docker Hub Description
      uses: peter-evans/dockerhub-description@v5
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
        repository: ${{ secrets.DOCKER_USERNAME }}/git-safe
        short-description: "Effortless file encryption for your git repos—pattern-matched, secure, and keyfile-flexible."
        readme-filepath: ./README.md
        enable-url-completion: true