release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      publish_to_pypi:
        description: "Publish built distributions to PyPI"
        required: true
        default: false
        type: boolean

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: Build release artifacts
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Install packaging dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install build twine

      - name: Build source and wheel distributions
        run: python -m build

      - name: Validate distribution metadata
        run: twine check dist/*

      - name: Verify tag matches built version
        if: github.event_name == 'push'
        run: |
          python - <<'PY'
          import re
          from pathlib import Path

          tag = "${{ github.ref_name }}"
          expected = tag[1:] if tag.startswith("v") else tag
          artifact = next(Path("dist").glob("infty-*.tar.gz"))
          match = re.match(r"infty-(.+)\.tar\.gz$", artifact.name)
          built_version = match.group(1) if match else None

          if built_version != expected:
              raise SystemExit(
                  f"Release tag {tag} does not match built package version {built_version}."
              )

          print(f"Verified release tag {tag} matches built package version {built_version}.")
          PY

      - name: Upload release artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-dist
          path: dist/*

  publish:
    name: Publish to PyPI
    needs: build
    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.publish_to_pypi)
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/infty
    steps:
      - name: Download release artifacts
        uses: actions/download-artifact@v4
        with:
          name: release-dist
          path: dist

      - name: Ensure PyPI token is configured
        env:
          PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        run: |
          if [ -z "${PYPI_API_TOKEN}" ]; then
            echo "PYPI_API_TOKEN secret is not configured for the 'pypi' environment." >&2
            echo "Add your existing project-scoped PyPI token as the environment secret PYPI_API_TOKEN." >&2
            exit 1
          fi

      - name: Publish distributions
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}

  github-release:
    name: Create GitHub release
    needs:
      - build
      - publish
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download release artifacts
        uses: actions/download-artifact@v4
        with:
          name: release-dist
          path: dist

      - name: Publish GitHub release
        uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          generate_release_notes: true