release.yml

name: release

# Tag vX.Y.Z on main -> verify version, build, GitHub Release, PyPI (trusted publishing, when the
# `pypi` environment exists). See RELEASING.md.

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.ver.outputs.version }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Tag must equal pyproject version
        id: ver
        run: |
          python -m pip install tomli
          pv=$(python -c "import tomli; print(tomli.load(open('pyproject.toml','rb'))['project']['version'])")
          tag="${GITHUB_REF_NAME#v}"
          if [[ "$pv" != "$tag" ]]; then echo "::error::tag v$tag != pyproject version $pv"; exit 1; fi
          echo "version=$pv" >> "$GITHUB_OUTPUT"
      - run: python -m pip install build twine
      - run: python -m build
      - run: python -m twine check dist/*
      - name: Extract this version's CHANGELOG section
        run: |
          python - <<'PY'
          import re, os
          v = os.environ["VERSION"]; text = open("CHANGELOG.md", encoding="utf-8").read()
          m = re.search(rf"^## \[{re.escape(v)}\][^\n]*\n(.*?)(?=^## \[|\Z)", text, re.S | re.M)
          body = m.group(1).strip() if m else f"See CHANGELOG.md for {v}."
          open("release_notes.md", "w", encoding="utf-8").write(body + "\n")
          PY
        env:
          VERSION: ${{ steps.ver.outputs.version }}
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: |
            dist/*
            release_notes.md

  github-release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
      - uses: softprops/action-gh-release@v2
        with:
          body_path: release_notes.md
          prerelease: ${{ contains(github.ref_name, 'rc') || contains(github.ref_name, 'a') || contains(github.ref_name, 'b') }}
          files: dist/*.whl dist/*.tar.gz

  pypi:
    # Runs only after the `pypi` environment with a trusted publisher exists (RELEASING.md §5);
    # without it the job fails on the OIDC exchange and the GitHub Release above still stands.
    needs: build
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist
      - run: rm -f dist/release_notes.md
      - uses: pypa/gh-action-pypi-publish@release/v1