release.yml

name: Release

on:
  push:
    tags: ["v*"]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions: {}

jobs:
  test:
    uses: ./.github/workflows/test.yml

  build:
    needs: test
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
          cache: pip
      - run: pip install build
      - run: python -m build
      - name: Verify version matches tag
        run: |
          TAG="${{ github.ref_name }}"
          EXPECTED="${TAG#v}"
          VERSION=$(python3 -c "
          import tomllib
          with open('pyproject.toml', 'rb') as f:
              print(tomllib.load(f)['project']['version'])
          ")
          if [ "$VERSION" != "$EXPECTED" ]; then
            echo "::error::Version mismatch: tag=$EXPECTED, pyproject.toml=$VERSION"
            exit 1
          fi
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/
          retention-days: 5

  publish:
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1

  github-release:
    needs: [build, publish]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
          REPO: ${{ github.repository }}
        run: |
          gh release delete "$TAG" --repo "$REPO" --yes 2>/dev/null || true
          gh release create "$TAG" dist/* --repo "$REPO" --generate-notes