release.yml

name: Release

# Publishes to PyPI when a version tag such as v0.2.0 is pushed.
# Uses PyPI trusted publishing (OIDC), so no API token is stored. PyPI needs a
# trusted publisher for this repository: workflow release.yml, environment pypi.
on:
  push:
    tags: ["v*.*.*"]

permissions:
  contents: read

jobs:
  check:
    name: Check version and tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: astral-sh/setup-uv@v7

      - name: Tag must match the package version
        shell: bash
        run: |
          tag="${GITHUB_REF_NAME#v}"
          project=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
          module=$(python3 -c "import re; print(re.search(r'__version__ = \"(.+?)\"', open('src/commitrocket/__init__.py').read()).group(1))")
          echo "tag=$tag pyproject=$project __init__=$module"
          if [ "$tag" != "$project" ] || [ "$tag" != "$module" ]; then
            echo "::error::Tag v$tag must match the version in pyproject.toml ($project) and src/commitrocket/__init__.py ($module)."
            exit 1
          fi

      - name: Install
        run: uv sync --python 3.11

      - name: Lint
        run: uv run ruff check .

      - name: Unit tests
        run: uv run pytest -m "not integration"

      - name: Integration tests
        run: uv run pytest -m integration

  publish:
    name: Build and publish
    needs: check
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v7

      - uses: astral-sh/setup-uv@v7

      - name: Build
        run: uv build

      - name: Publish to PyPI
        run: uv publish --trusted-publishing always

      - name: GitHub release
        uses: softprops/action-gh-release@v3
        with:
          generate_release_notes: true
          files: dist/*