release.yml

name: Release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Check the tag against the package version
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          version=$(python3 -c 'import re, pathlib; print(re.search(r"__version__ = \"([^\"]+)\"", pathlib.Path("src/nnnotes/__init__.py").read_text()).group(1))')
          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
            echo "tag $GITHUB_REF_NAME and package $version differ" >&2
            exit 1
          fi
          if ! grep -qF "## [$version]" CHANGELOG.md; then
            echo "CHANGELOG.md has no section for $version" >&2
            exit 1
          fi

  quality:
    needs: check
    uses: ./.github/workflows/ci.yml

  # the sdist and one pure Python wheel; the wheel is tested with the deck model the extra pins
  build:
    needs: [check, quality]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.13"
      - name: Build and check the distributions
        run: |
          python -m pip install --upgrade pip build twine
          python -m build --outdir dist
          python -m twine check --strict dist/*
          ls dist
      - name: Test the installed wheel
        run: python .github/scripts/smoke_wheel.py dist
      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  pypi:
    needs: build
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/nnnotes/
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/
      # trusted publishing: PyPI accepts this workflow's OIDC token, no API token is stored
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true

  github-release:
    needs: pypi
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Release notes
        uses: orhun/git-cliff-action@v4
        with:
          config: cliff.toml
          args: --latest --strip header
        env:
          OUTPUT: RELEASE_NOTES.md
          GITHUB_REPO: ${{ github.repository }}
      - name: Use reviewed release notes when available
        run: |
          reviewed="release-notes/${GITHUB_REF_NAME}.txt"
          if [ -f "$reviewed" ]; then
            cp "$reviewed" RELEASE_NOTES.md
          fi
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/
      - name: GitHub release
        uses: softprops/action-gh-release@v3
        with:
          body_path: RELEASE_NOTES.md
          files: |
            dist/*.tar.gz
            dist/*.whl