publish.yml

name: publish

# Publishes to PyPI via Trusted Publishing (OIDC) when a GitHub Release is
# published — no API token is stored. Configure the trusted publisher once on
# PyPI: project "lokf", owner "nicholsn", repo "lokf", workflow "publish.yml",
# environment "pypi".
on:
  release:
    types: [published]
  workflow_dispatch:

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v5
      - uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      # A release tag whose version was never bumped in pyproject.toml only
      # surfaces at upload time, as an opaque PyPI "400 File already exists".
      # Fail here instead, before the tests even run.
      - name: Check the release tag matches the package version
        if: github.event_name == 'release'
        run: |
          tag="${GITHUB_REF_NAME#v}"
          packaged="$(uv version --short)"
          if [ "$tag" != "$packaged" ]; then
            echo "::error::Release tag v$tag does not match pyproject.toml version $packaged — bump the version, merge, then re-tag."
            exit 1
          fi

      - name: Test (gate the release)
        run: uv run --group dev pytest -q

      - name: Build sdist + wheel
        run: uv build

      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/

  publish:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/lokf/
    permissions:
      id-token: write # OIDC token for Trusted Publishing
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1