python-publish.yml

name: Python Publish

on:
  release:
    types: [published]

jobs:
  install-test-and-build:
    name: Install, test & build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - name: Generate GitHub App token
      id: app-token
      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
      with:
        client-id: ${{ vars.APP_CLIENT_ID }}
        private-key: ${{ secrets.APP_PRIVATE_KEY }}

    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        ref: main
        fetch-depth: 0
        token: ${{ steps.app-token.outputs.token }}

    - name: Set up Python
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: "3.10"

    - name: Install uv
      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0

    - name: Bump version from tag
      run: |
        TAG_NAME="${{ github.event.release.tag_name }}"
        # expecting tags like v1.2.3
        VERSION="${TAG_NAME#v}"
        if [ -z "$VERSION" ]; then
          echo "Could not extract version from tag: $TAG_NAME" >&2
          exit 1
        fi
        echo "VERSION=$VERSION" >> "$GITHUB_ENV"
        uv run python scripts/bump_version.py "$VERSION"

    - name: Test
      run: |
        uv sync
        uv run pytest tests

    - name: Build the package
      run: |
        rm -rf dist
        uv build

    - name: Commit version bump
      env:
        GH_TOKEN: ${{ steps.app-token.outputs.token }}
      run: |
        git config user.name "github-actions[bot]"
        git config user.email "github-actions[bot]@users.noreply.github.com"

        # Explicitly set the remote URL with the app token
        git remote set-url origin https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git

        # Add changed files
        git add pyproject.toml uv.lock novem/version.py

        # Only commit if there are changes
        if ! git diff --cached --quiet; then
          git commit -m "Release v$VERSION"
          git push origin main
        else
          echo "No changes to commit"
        fi

    - name: Storage wheel
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: python-wheel
        path: dist/
        retention-days: 1

  publish:
    name: Publish
    runs-on: ubuntu-latest
    needs: install-test-and-build
    environment:
      name: release
      url: https://pypi.org/p/novem
    permissions:
      id-token: write
    steps:
    - name: Retrieve wheel
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: python-wheel
        path: dist/

    - name: Publish package distributions to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1

    - name: Send release notification to Discord
      if: success() && github.repository_owner == 'novem-code'
      env:
        RELEASE_NAME: ${{ github.event.release.name }}
        RELEASE_TAG: ${{ github.event.release.tag_name }}
        RELEASE_URL: ${{ github.event.release.html_url }}
        REPO_FULL_NAME: ${{ github.repository }}
        DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_URL }}
      run: |
        REPO_NAME=$(echo $REPO_FULL_NAME | cut -d'/' -f2)
        MESSAGE=$(jq -n \
          --arg repo "$REPO_NAME" \
          --arg tag "$RELEASE_TAG" \
          --arg name "$RELEASE_NAME" \
          --arg url "$RELEASE_URL" \
          --arg icon "🚀" \
          '{content: "\($icon) \($repo) > [\($tag): \($name)](<\($url)>) has been released!"}')
        curl -H "Content-Type: application/json" \
          -X POST \
          -d "$MESSAGE" \
          "$DISCORD_WEBHOOK"