release.yml

name: Release

# Runs on every push to main. python-semantic-release inspects the
# Conventional Commits since the last v* tag, decides the next version,
# bumps pyproject.toml, writes CHANGELOG.md, tags, and creates a GitHub
# Release. If (and only if) a release was cut, the deploy job uploads the
# built distributions to PyPI via Trusted Publishing (OIDC, no secrets).
#
# Pushes made with GITHUB_TOKEN do not re-trigger workflows, so the version
# bump commit PSR pushes back to main will not cause a loop.

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

jobs:
  release:
    runs-on: ubuntu-latest
    concurrency:
      group: ${{ github.workflow }}-release-${{ github.ref_name }}
      cancel-in-progress: false
    permissions:
      contents: write # push the version bump commit + tag, create the GitHub Release
    outputs:
      released: ${{ steps.release.outputs.released || 'false' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # PSR needs full history + tags to compute the version
          ref: ${{ github.ref_name }}

      - name: Pin release branch to the triggering commit
        run: git reset --hard ${{ github.sha }}

      - name: Semantic version release
        id: release
        # Pinned to a known-good tag; bump to the latest v10.x as needed.
        uses: python-semantic-release/python-semantic-release@v10.5.3
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          git_committer_name: "github-actions"
          git_committer_email: "actions@users.noreply.github.com"

      - name: Attach distributions to the GitHub Release
        if: steps.release.outputs.released == 'true'
        uses: python-semantic-release/publish-action@v10.5.3
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ steps.release.outputs.tag }}

      - name: Upload distributions for the deploy job
        if: steps.release.outputs.released == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: distribution-artifacts
          path: dist
          if-no-files-found: error

  deploy:
    runs-on: ubuntu-latest
    needs: release
    if: ${{ needs.release.outputs.released == 'true' }}
    environment:
      name: pypi
      url: https://pypi.org/p/ai-agent-bridge
    permissions:
      id-token: write # OIDC token for PyPI Trusted Publishing
    steps:
      - name: Download built distributions
        uses: actions/download-artifact@v4
        with:
          name: distribution-artifacts
          path: dist

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist
          print-hash: true