release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

jobs:
  publish-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - uses: astral-sh/setup-uv@v7

      - name: Verify tag matches version
        run: |
          python - <<'PY'
          import os
          import sys
          import tomllib

          tag = os.environ.get("GITHUB_REF_NAME", "")
          with open("pyproject.toml", "rb") as handle:
              version = tomllib.load(handle)["project"]["version"]
          expected = f"v{version}"
          if tag != expected:
              print(f"Tag {tag} does not match version {version}")
              sys.exit(1)
          PY

      - name: Install deps
        run: uv pip install --system -e ".[dev]"

      - name: Ruff
        run: uv run ruff check src test

      - name: Mypy
        run: uv run mypy src/kinexon_handball_api

      - name: Pytest
        run: uv run pytest

      - name: Build artifacts
        run: |
          uv build

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          path: dist
          artifact-name: kinexon-handball-sbom

      - name: Upload release artifacts
        uses: actions/upload-artifact@v7
        with:
          name: kinexon-handball-dist
          path: dist/*

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: dist/*

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: dist/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist