publish.yml

name: Publish

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  ci:
    name: CI
    uses: ./.github/workflows/ci.yml

  check-version:
    name: Version Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - name: Verify tag matches package version
        env:
          TAG: ${{ github.ref_name }}
        run: |
          TAG_VERSION="${TAG#v}"
          PKG_VERSION=$(python3 -c "
          import re
          with open('pyproject.toml') as f:
              for line in f:
                  m = re.match(r'^version\s*=\s*\"(.+)\"', line)
                  if m:
                      print(m.group(1))
                      break
          ")
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Tag version ($TAG_VERSION) does not match package version ($PKG_VERSION)"
            exit 1
          fi
          echo "Version check passed: $TAG_VERSION"

  publish:
    name: Publish
    runs-on: ubuntu-latest
    needs:
      - ci
      - check-version
    permissions:
      id-token: write
      contents: write
    environment:
      name: pypi
      url: https://pypi.org/p/dotsman
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"
      - name: Build package
        run: uv build
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # v1.14.1
      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: gh release create "$TAG" dist/* --generate-notes