release.yml

# SPDX-FileCopyrightText: 2025 FanaticPythoner
# SPDX-License-Identifier: Apache-2.0

name: Release (tagged)

on:
  push:
    tags:
      - "v*.*.*"        # GLOB pattern for SemVer-like tags

permissions:
  contents: write
  id-token: write      # REQUIRED for PyPI Trusted Publishers (OIDC)

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout (full history)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Verify pyproject version == tag (safety)
        shell: bash
        run: |
          set -euo pipefail
          TAG="${{ github.ref_name }}"
          TAG_VER="${TAG#v}"
          PROJ_VER="$(python -c 'import tomllib; print((tomllib.load(open("pyproject.toml","rb")).get("project") or {}).get("version") or "")')"
          if [ -z "${PROJ_VER}" ]; then
            echo "ERROR: [project].version missing in pyproject.toml"; exit 2
          fi
          if [ "${PROJ_VER}" != "${TAG_VER}" ]; then
            echo "pyproject.toml version (${PROJ_VER}) != tag (${TAG_VER})"; exit 1
          fi
          echo "Version OK: ${PROJ_VER} == ${TAG_VER}"

      - id: pack
        name: Build artifacts
        uses: ./.github/actions/build-dist
        with:
          python_version: "3.12"

      - name: Create/Update Release (purge + upload)
        uses: ./.github/actions/release-assets
        with:
          release_tag: ${{ github.ref_name }}
          release_name: Release ${{ github.ref_name }}
          prerelease: "false"
          purge_existing_assets: "true"
          create_or_move_tag: "false"
          dist_dir: ${{ steps.pack.outputs.dist_dir }}

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ secrets.PYPI_API_TOKEN }}
          packages-dir: ${{ steps.pack.outputs.dist_dir }}
          # Force a hard error if the version already exists,
          # so we never "succeed" without uploading.
          skip-existing: false
          print-hash: true