release.yml

name: Release

# Triggered by pushing a SemVer tag (vMAJOR.MINOR.PATCH). The strict pattern
# also rejects accidental tags like `release-1` or `0.6.0` (missing v).
on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"

permissions:
  contents: write # create release + upload assets

jobs:
  build:
    name: Build wheel + sdist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # hatch-vcs needs full history + tags

      - name: Verify tag commit is on main
        run: |
          git fetch --no-tags --depth=1 origin main
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            echo "::error::Tag commit $GITHUB_SHA is not on main; refusing to release."
            exit 1
          fi

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

      - name: Build frontend bundle
        run: |
          npm --prefix frontend ci
          npm --prefix frontend run build

      - name: Build sdist + wheel
        run: |
          pip install build
          python -m build

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  release:
    name: Publish GitHub Release
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          generate_release_notes: true
          fail_on_unmatched_files: true