release.yml

name: Release

on:
  push:
    branches:
      - main
      - beta
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      ref:
        description: Git ref to build (tag/sha/branch). Leave empty to use current.
        required: false
        default: ""

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    outputs:
      released: ${{ steps.semantic.outputs.released }}
      version: ${{ steps.semantic.outputs.version }}
      tag: ${{ steps.semantic.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Python Semantic Release
        id: semantic
        if: github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')
        uses: python-semantic-release/python-semantic-release@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}

  publish-pypi:
    needs: release
    runs-on: ubuntu-latest
    if: >-
      (github.event_name == 'push' && (needs.release.outputs.released == 'true' || startsWith(github.ref, 'refs/tags/')))
      || github.event_name == 'workflow_dispatch'
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.ref || needs.release.outputs.tag || github.ref }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Validate tag matches pyproject.toml version
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
          PKG_VERSION=$(python -c "
          import re
          with open('pyproject.toml') as f:
              m = re.search(r'version\s*=\s*\"([^\"]+)\"', f.read())
              print(m.group(1) if m else '')
          ")
          echo "Tag version: $TAG_VERSION"
          echo "Package version: $PKG_VERSION"
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Tag version ($TAG_VERSION) does not match pyproject.toml version ($PKG_VERSION)"
            exit 1
          fi

      - name: Refresh versioned release docs
        run: |
          python -m utils.release_docs version-docs --changelog CHANGELOG.md --output-dir docs/releases || true

      - name: Build package
        run: |
          python -m pip install --upgrade pip
          python -m pip install build twine
          python -m build
          python -m twine check dist/*

      - name: Upload to PyPI
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
        run: |
          python -m twine upload --non-interactive --skip-existing dist/*

      - name: Determine prerelease
        id: prerelease
        run: |
          VERSION=$(python -c "
          import re
          with open('pyproject.toml') as f:
              m = re.search(r'version\s*=\s*\"([^\"]+)\"', f.read())
              print(m.group(1) if m else '')
          ")
          if echo "$VERSION" | grep -qE '[a-zA-Z]'; then
            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload to GitHub Release
        if: startsWith(github.ref, 'refs/tags/') || needs.release.outputs.released == 'true'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.release.outputs.tag || github.ref_name }}
          prerelease: ${{ steps.prerelease.outputs.is_prerelease }}
          files: dist/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-npm:
    needs: release
    runs-on: ubuntu-latest
    if: >-
      ((github.event_name == 'push' && needs.release.outputs.released == 'true')
      || github.event_name == 'workflow_dispatch')
      && hashFiles('package.json') != ''
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.ref || needs.release.outputs.tag || github.sha }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          registry-url: "https://registry.npmjs.org"

      - name: Publish to npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public