release.yml

name: Release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"

jobs:
  test-and-build:
    runs-on: ubuntu-latest
    outputs:
      notes: ${{ steps.extract-notes.outputs.notes }}
    steps:
      - uses: actions/checkout@v6

      - name: Set up Python 3.12
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Verify tag matches package version
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PKG_VERSION=$(python -c "
          import tomllib
          with open('pyproject.toml', 'rb') as f:
              data = tomllib.load(f)
          print(data['project']['version'])
          ")
          echo "Tag version:     $TAG_VERSION"
          echo "Package version: $PKG_VERSION"
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "ERROR: git tag '$GITHUB_REF_NAME' does not match pyproject.toml version '$PKG_VERSION'"
            exit 1
          fi

      - name: Lint
        run: ruff check src/

      - name: Run tests
        run: pytest -v --tb=short

      - name: Build sdist and wheel
        run: |
          pip install build
          python -m build

      - name: Read release notes
        id: extract-notes
        run: |
          {
            echo "notes<<EOF"
            cat release-notes.md
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Upload dist artifact
        uses: actions/upload-artifact@v6
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  github-release:
    needs: test-and-build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@v7
        with:
          name: dist
          path: dist/

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          body: ${{ needs.test-and-build.outputs.notes }}
          files: dist/*
          fail_on_unmatched_files: true

  publish:
    needs: github-release
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write
    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@v7
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1