publish.yml

name: Publish to PyPI

on:
  release:
    types: [published]

jobs:
  build-and-publish:
    name: Build and publish to PyPI
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing

    steps:
    - uses: actions/checkout@v4
    
    - name: Set up Python
      uses: actions/setup-python@v7
      with:
        python-version: "3.10"
        
    - name: Install build tools
      run: |
        python -m pip install --upgrade pip
        pip install build
        
    - name: Build package
      run: python -m build

    - name: Validate built wheel contents
      run: |
        python -c "import glob, os, zipfile; wheel = max(glob.glob('dist/*.whl'), key=os.path.getmtime); names = set(zipfile.ZipFile(wheel).namelist()); assert any(name.endswith('wireshark_mcp/skills/wireshark-traffic-analysis/SKILL.md') for name in names), 'Skill package missing from wheel'"

    - name: Install built wheel
      run: |
        python -c "import glob, os, subprocess, sys; wheel = max(glob.glob('dist/*.whl'), key=os.path.getmtime); subprocess.check_call([sys.executable, '-m', 'pip', 'install', '--force-reinstall', wheel])"

    - name: Run release smoke tests
      run: |
        wireshark-mcp --version
        python -m wireshark_mcp.server --version
        wireshark-mcp config
        wireshark-mcp doctor
        wireshark-mcp doctor --format json
        wireshark-mcp clients
        wireshark-mcp clients --format json
        wireshark-mcp --config
      
    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1
      # Note: No username/password needed if using Trusted Publishing (OIDC).
      # If using legacy token, uncomment below:
      # with:
      #   password: ${{ secrets.PYPI_API_TOKEN }}

    - name: Notify Homebrew tap to bump formula
      env:
        TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
      # Only fire when the secret is present (forks / PRs won't have it)
      if: env.TAP_TOKEN != ''
      run: |
        VERSION="${{ github.event.release.tag_name }}"
        VERSION="${VERSION#v}"   # strip leading 'v' if present
        curl --fail-with-body -sS -X POST \
          -H "Authorization: Bearer $TAP_TOKEN" \
          -H "Accept: application/vnd.github+json" \
          https://api.github.com/repos/bx33661/homebrew-wireshark-mcp/dispatches \
          -d "{\"event_type\":\"new-release\",\"client_payload\":{\"version\":\"$VERSION\"}}"