ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          pip install -e ".[dev]"

      - name: Lint
        run: ruff check src/ tests/

      - name: Type check
        run: mypy src/oneclaw/ --ignore-missing-imports

      - name: Test
        run: pytest -v

  publish:
    needs: test
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    permissions:
      id-token: write
    environment:
      name: pypi
      url: https://pypi.org/p/oneclaw
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Build
        run: |
          pip install build
          python -m build

      # PyPI will not let a version be replaced, so a bad or duplicate upload
      # burns that version number permanently. Both checks run before the push.
      - name: Check the artifacts
        run: |
          pip install twine
          twine check dist/*

      - name: Refuse a version that is already on PyPI
        run: |
          VERSION=$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
          if curl -sf "https://pypi.org/pypi/oneclaw/$VERSION/json" >/dev/null 2>&1; then
            echo "oneclaw $VERSION is already published. Bump the version in pyproject.toml."
            exit 1
          fi
          echo "oneclaw $VERSION is not on PyPI yet."

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1