release.yml

name: Release

# A v* tag builds the sdist and the wheel and attaches them to a GitHub release.
# Publishing to PyPI (trusted publishing, environment "pypi") runs only when the
# repository variable PYPI_PUBLISH is "true". To publish a tag that was released
# before that, run this workflow by hand with the tag.

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: "An existing release tag, e.g. v0.1.1"
        required: true
        type: string

permissions:
  contents: read

env:
  TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}

concurrency:
  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
  cancel-in-progress: false

jobs:
  build:
    name: Build distributions
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: refs/tags/${{ env.TAG }}
          persist-credentials: false
      - uses: actions/setup-python@v7
        with:
          python-version: "3.13"
      - name: Check the tag matches the package version
        run: |
          version=$(sed -n 's/^__version__ = "\(.*\)"$/\1/p' flaggr/_version.py)
          if [ "v${version}" != "${TAG}" ]; then
            echo "::error::Tag ${TAG} doesn't match the package version ${version} (flaggr/_version.py)"
            exit 1
          fi
      - name: Test
        env:
          PYTHONDONTWRITEBYTECODE: "1"
        run: |
          python -m pip install -e . pytest
          python -m pytest -p no:cacheprovider
      - name: Build
        run: |
          python -m pip install build twine
          python -m build
          python -m twine check --strict dist/*
      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  github-release:
    name: GitHub release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/
      - name: Create the release, or replace its files
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          if gh release view "${TAG}" >/dev/null 2>&1; then
            gh release upload "${TAG}" dist/* --clobber
          else
            gh release create "${TAG}" dist/* --verify-tag --title "${TAG}" --generate-notes
          fi

  pypi:
    name: Publish to PyPI
    needs: build
    if: vars.PYPI_PUBLISH == 'true'
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/flaggr/
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          skip-existing: true