release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g., 1.0.0)'
        required: true
        type: string
      create_tag:
        description: 'Create tag for this version'
        required: true
        type: boolean
        default: true

env:
  PYTHON_VERSION: "3.11"

jobs:
  validate-version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag_name: ${{ steps.version.outputs.tag_name }}
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Extract version
      id: version
      run: |
        if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
          VERSION="${{ github.event.inputs.version }}"
          TAG_NAME="v${VERSION}"
        else
          TAG_NAME="${GITHUB_REF#refs/tags/}"
          VERSION="${TAG_NAME#v}"
        fi

        echo "version=${VERSION}" >> $GITHUB_OUTPUT
        echo "tag_name=${TAG_NAME}" >> $GITHUB_OUTPUT
        echo "Version: ${VERSION}"
        echo "Tag: ${TAG_NAME}"

    - name: Validate version format
      run: |
        VERSION="${{ steps.version.outputs.version }}"
        if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+)?$ ]]; then
          echo "Invalid version format: $VERSION"
          echo "Expected format: X.Y.Z or X.Y.Z-suffix"
          exit 1
        fi

  create-tag:
    runs-on: ubuntu-latest
    needs: validate-version
    if: github.event_name == 'workflow_dispatch' && github.event.inputs.create_tag == 'true'
    steps:
    - uses: actions/checkout@v4

    - name: Create and push tag
      run: |
        git config user.name "github-actions[bot]"
        git config user.email "github-actions[bot]@users.noreply.github.com"
        git tag ${{ needs.validate-version.outputs.tag_name }}
        git push origin ${{ needs.validate-version.outputs.tag_name }}

  build:
    runs-on: ubuntu-latest
    needs: validate-version
    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHON_VERSION }}

    - name: Install uv
      uses: astral-sh/setup-uv@v4

    - name: Install dependencies
      run: uv sync --group build

    - name: Update version in code
      run: |
        VERSION="${{ needs.validate-version.outputs.version }}"
        echo "__version__ = '${VERSION}'" > src/fastapi_jwt_harmony/version.py

    - name: Build package
      run: uv build

    - name: Check package
      run: uv run --group build twine check dist/*

    - name: Upload build artifacts
      uses: actions/upload-artifact@v4
      with:
        name: dist
        path: dist/
        retention-days: 7

  test-install:
    runs-on: ${{ matrix.os }}
    needs: build
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python-version: ["3.11", "3.12"]

    steps:
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}

    - name: Download build artifacts
      uses: actions/download-artifact@v4
      with:
        name: dist
        path: dist/

    - name: Test installation
      shell: bash
      run: |
        # Find and install the wheel file
        WHEEL_FILE=$(find dist -name "*.whl" | head -1)
        pip install "$WHEEL_FILE"
        python -c "import fastapi_jwt_harmony; print(f'Successfully imported version {fastapi_jwt_harmony.__version__}')"

  create-release:
    runs-on: ubuntu-latest
    needs: [validate-version, build, test-install]
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Download build artifacts
      uses: actions/download-artifact@v4
      with:
        name: dist
        path: dist/

    - name: Generate changelog
      id: changelog
      run: |
        VERSION="${{ needs.validate-version.outputs.version }}"
        TAG_NAME="${{ needs.validate-version.outputs.tag_name }}"

        # Get the previous tag (if exists)
        PREV_TAG=$(git describe --tags --abbrev=0 ${TAG_NAME}^ 2>/dev/null || echo "")

        echo "## What's Changed" > release_notes.md
        echo "" >> release_notes.md

        # Get commits since last tag (or all commits for first release)
        if [ -n "$PREV_TAG" ]; then
          git log ${PREV_TAG}..${TAG_NAME} --pretty=format:"* %s (@%an)" >> release_notes.md || true
        else
          echo "This is the first release of FastAPI JWT Harmony! 🎉" >> release_notes.md
          echo "" >> release_notes.md
          echo "### Key Features:" >> release_notes.md
          echo "- 🔒 Type-safe JWT authentication with Pydantic models" >> release_notes.md
          echo "- 🚀 FastAPI dependency injection" >> release_notes.md
          echo "- 📍 Multiple token locations (headers & cookies)" >> release_notes.md
          echo "- 🛡️ CSRF protection for cookies" >> release_notes.md
          echo "- 🌐 WebSocket support" >> release_notes.md
          echo "- 🚫 Token denylist support" >> release_notes.md
          echo "- 🔐 Asymmetric algorithms (RS256, ES256, etc.)" >> release_notes.md
          echo "- ✅ 100% test coverage" >> release_notes.md
        fi

        echo "" >> release_notes.md
        echo "## Installation" >> release_notes.md
        echo "" >> release_notes.md
        echo "\`\`\`bash" >> release_notes.md
        echo "pip install fastapi-jwt-harmony==${VERSION}" >> release_notes.md
        echo "\`\`\`" >> release_notes.md
        echo "" >> release_notes.md
        if [ -n "$PREV_TAG" ]; then
          echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/${PREV_TAG}...${TAG_NAME}" >> release_notes.md
        else
          echo "**Full Changelog**: https://github.com/${{ github.repository }}/commits/${TAG_NAME}" >> release_notes.md
        fi

    - name: Create GitHub Release
      uses: softprops/action-gh-release@v1
      with:
        tag_name: ${{ needs.validate-version.outputs.tag_name }}
        name: Release ${{ needs.validate-version.outputs.tag_name }}
        body_path: release_notes.md
        files: |
          dist/*
        draft: false
        prerelease: ${{ contains(needs.validate-version.outputs.version, '-') }}
        generate_release_notes: true

  publish-pypi:
    runs-on: ubuntu-latest
    needs: [validate-version, create-release]
    environment:
      name: pypi
      url: https://pypi.org/p/fastapi-jwt-harmony
    permissions:
      id-token: write  # For trusted publishing

    steps:
    - name: Download build artifacts
      uses: actions/download-artifact@v4
      with:
        name: dist
        path: dist/

    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        packages-dir: dist/
        verbose: true

  announce:
    runs-on: ubuntu-latest
    needs: [validate-version, publish-pypi]
    if: always() && needs.publish-pypi.result == 'success'
    steps:
    - name: Create success summary
      run: |
        echo "## 🎉 Release ${{ needs.validate-version.outputs.tag_name }} Published Successfully!" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "### 📦 Package Information" >> $GITHUB_STEP_SUMMARY
        echo "- **Version**: ${{ needs.validate-version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
        echo "- **PyPI**: https://pypi.org/project/fastapi-jwt-harmony/${{ needs.validate-version.outputs.version }}/" >> $GITHUB_STEP_SUMMARY
        echo "- **GitHub Release**: https://github.com/${{ github.repository }}/releases/tag/${{ needs.validate-version.outputs.tag_name }}" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "### 🚀 Installation" >> $GITHUB_STEP_SUMMARY
        echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
        echo "pip install fastapi-jwt-harmony==${{ needs.validate-version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
        echo "\`\`\`" >> $GITHUB_STEP_SUMMARY