publish.yml

name: Publish

# Publishes to PyPI via Trusted Publishing (OIDC) — no API tokens stored.
# One-time setup on PyPI: Project → Publishing → add a GitHub publisher with
#   owner: SkyLink-API | repository: SkyLink-API-Python-SDK | workflow: publish.yml | environment: pypi
#
# Every push to main builds and — when src/skylink_api/_version.py holds a version
# that is not on PyPI yet — publishes it. Pushing a `v*` tag still works and
# additionally asserts the tag matches the package version.
on:
  push:
    branches: [main]
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: publish
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      unpublished: ${{ steps.pypi.outputs.unpublished }}
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
          cache: pip

      - run: pip install -e ".[dev]"

      - name: Read the package version
        id: version
        run: |
          VERSION=$(python -c "from skylink_api._version import __version__; print(__version__)")
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "package version: $VERSION"

      - name: Verify the tag matches the package version
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          VERSION="${{ steps.version.outputs.version }}"
          echo "tag=$TAG package=$VERSION"
          if [ "$TAG" != "$VERSION" ]; then
            echo "::error::Tag v$TAG does not match package version $VERSION"
            exit 1
          fi

      - name: Check whether this version is already on PyPI
        id: pypi
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          CODE=$(curl -s -o /dev/null -w '%{http_code}' "https://pypi.org/pypi/skylink-api/$VERSION/json")
          if [ "$CODE" = "404" ]; then
            echo "unpublished=true" >> "$GITHUB_OUTPUT"
            echo "skylink-api $VERSION is not on PyPI yet — it will be published."
          else
            echo "unpublished=false" >> "$GITHUB_OUTPUT"
            echo "skylink-api $VERSION already exists on PyPI (HTTP $CODE) — publish will be skipped."
          fi

      - name: Run the test suite before releasing
        run: pytest --ignore=tests/integration

      - run: python -m build

      - run: twine check dist/*

      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish:
    needs: build
    if: needs.build.outputs.unpublished == 'true'
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/skylink-api
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1