publish-main.yml

name: publish-main

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to publish (e.g. v0.8.0)"
        required: true

permissions:
  contents: write
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    environment:
      name: pypi
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      - name: Ensure tag commit is on main
        run: |
          git fetch origin main --prune
          if ! git merge-base --is-ancestor "${GITHUB_SHA}" "origin/main"; then
            echo "Tag commit ${GITHUB_SHA} is not on origin/main"
            exit 1
          fi

      - name: Setup Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.11"
          cache: "pip"

      - name: Install Poetry
        run: pip install poetry

      - name: Validate tag matches pyproject version
        env:
          TAG: ${{ github.event.inputs.tag || github.ref_name }}
        run: |
          python3 - <<'PY'
          import re
          from pathlib import Path
          import os

          tag = os.environ["TAG"]
          if not tag.startswith("v"):
            raise SystemExit(f"Tag must start with v, got: {tag}")
          tag_ver = tag[1:]

          text = Path("pyproject.toml").read_text()
          m = re.search(r'^version\s*=\s*"(\d+\.\d+\.\d+)"\s*$', text, flags=re.M)
          if not m:
            raise SystemExit("Could not read version from pyproject.toml")
          pkg_ver = m.group(1)

          if pkg_ver != tag_ver:
            raise SystemExit(f"Version mismatch: tag={tag_ver}, pyproject={pkg_ver}")

          print(f"Version validated: {pkg_ver}")
          PY

      - name: Install dependencies
        run: poetry install --with dev

      - name: Quality gates
        run: make ci

      - name: Build package
        run: poetry build

      - name: Publish to PyPI (Trusted Publisher)
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

      - name: Upload dist artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: dist-${{ github.event.inputs.tag || github.ref_name }}
          path: dist/*

      - name: Create GitHub Release
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
        with:
          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
          generate_release_notes: true
          files: |
            dist/*