release.yml

name: release

on:
  release:
    types: [released, prereleased]

env:
  UUID: ${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}

permissions: {}

jobs:
  tag-and-version-match:
    name: Validate that the tag and version match
    runs-on: ubuntu-latest
    steps:
      - name: Checkout `pyproject.toml`
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          sparse-checkout: pyproject.toml
          sparse-checkout-cone-mode: false

      - shell: bash
        run: |
          set -eu

          tag="${GITHUB_REF_NAME}"
          version=$(grep -Po '^version\s*=\s*"\K[^"]+' pyproject.toml)

          if [[ "${tag}" != "${version}" ]]; then
            >&2 echo "Invalid tag: it doesn't match package version"
            exit 1
          fi

  build:
    name: Build package distributions
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs: [tag-and-version-match]
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python 3.14
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.14"

      - name: Build package distributions
        run: python -m pip install build && python -m build

      - name: Checks whether distribution’s long description will render correctly on PyPI
        continue-on-error: true
        run: |
          python -m pip install twine
          python -m twine check dist/*

      - name: Upload package distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ env.UUID }}
          path: dist/

  publish:
    name: Publish package distributions to PyPI using trusted publisher
    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write
    needs: [build]
    steps:
      - name: Download package distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ env.UUID }}
          path: dist/

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          verify-metadata: false

  clean:
    name: Delete package distributions artifacts
    runs-on: ubuntu-latest
    if: always()
    needs: [publish]
    steps:
      - uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
        with:
          name: ${{ env.UUID }}