publish.yml

name: Publish to PyPI

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read

jobs:
  # Run lint first to make sure the tag is good
  lint:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.13'

    - name: Install dependencies
      run: pip install flake8 black

    - name: Run Black (Code Formatting)
      run: black --check --line-length=120 src/workbench applications tests

    - name: Run Flake8 (Linting)
      run: flake8 --exclude '*generated*' src/workbench applications tests

  publish:
    needs: lint
    runs-on: ubuntu-latest
    permissions:
      id-token: write  # Required for trusted publishing
      contents: write  # Required for creating GitHub releases

    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0  # Full history for changelog generation

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.13'

    - name: Install build tools
      run: python -m pip install --upgrade pip build

    - name: Build package
      run: python -m build

    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1

    - name: Create GitHub Release
      env:
        GH_TOKEN: ${{ github.token }}
      run: |
        TAG="${GITHUB_REF#refs/tags/}"
        PREV_TAG=$(git describe --tags --abbrev=0 "${TAG}^" 2>/dev/null || echo "")
        if [ -n "$PREV_TAG" ]; then
          NOTES=$(git log --pretty=format:"- %s" "${PREV_TAG}..${TAG}" | head -50)
        else
          NOTES="Initial release"
        fi
        gh release create "$TAG" dist/* \
          --title "$TAG" \
          --notes "$NOTES"