release.yaml

name: Release

on:
  push:
    tags:
    - v*

permissions:
  contents: read

env:
  PYTHON_VERSION: '3.10'

jobs:
  release:
    name: Publish GitHub Release
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0
    - uses: ./.github/actions/setup-python-uv
      with:
        python-version: ${{ env.PYTHON_VERSION }}
    # tomllib is 3.11+, and PYTHON_VERSION is 3.10 to match this template's
    # floor, so the version is read with a regex instead. The pattern mirrors
    # VERSION_LINE in scripts/release.py, which writes this same line.
    - name: Verify tag matches the project version
      run: |
        tag_version="${GITHUB_REF_NAME#v}"
        project_version=$(uv run --locked python -c \
          "import pathlib, re; print(re.search(r'(?m)^version\s*=\s*\"([^\"]+)\"', pathlib.Path('pyproject.toml').read_text()).group(1))")
        if [ "$tag_version" != "$project_version" ]; then
          echo "::error::Tag $GITHUB_REF_NAME does not match pyproject.toml version $project_version"
          exit 1
        fi
    - name: Build and verify package artifacts
      run: uv run --locked --extra dev tox run -e build
    - name: Extract release notes
      run: |
        uv run --locked --extra dev python scripts/gen_changelog.py \
          --current --strip header -o release-notes.md
        if [ ! -s release-notes.md ]; then
          echo "::error::No changelog content found for $GITHUB_REF_NAME"
          exit 1
        fi
        cat release-notes.md
    - name: Create GitHub Release
      uses: softprops/action-gh-release@v2
      with:
        name: ${{ github.ref_name }}
        body_path: release-notes.md
        files: |
          dist/*.whl
          dist/*.tar.gz
        draft: false
        prerelease: false

  # Publishing to PyPI is opt-in. To enable it:
  #   1. Create a PyPI Trusted Publisher for this repository, pointing at
  #      workflow `release.yaml` and environment `pypi`.
  #      See https://docs.pypi.org/trusted-publishers/
  #   2. Create a GitHub environment named `pypi`.
  #   3. Uncomment the job below.
  # No API token is needed; authentication uses OIDC.
  #
  # publish:
  #   name: Publish to PyPI
  #   needs: release
  #   runs-on: ubuntu-latest
  #   timeout-minutes: 15
  #   environment: pypi
  #   permissions:
  #     id-token: write
  #   steps:
  #   - uses: actions/checkout@v6
  #   - uses: ./.github/actions/setup-python-uv
  #     with:
  #       python-version: ${{ env.PYTHON_VERSION }}
  #   - name: Build distributions
  #     run: uv run --locked --extra dev tox run -e build
  #   - name: Publish
  #     uses: pypa/gh-action-pypi-publish@release/v1