release.yml

name: Release

# Tag-driven publish. Push a v* tag and this builds, verifies, publishes to
# PyPI via OIDC trusted publishing, and opens a GitHub Release.
#
# NO API TOKEN IS STORED ANYWHERE. Trusted publishing has PyPI verify a
# short-lived OIDC token minted by GitHub for this specific repo + workflow +
# environment, so there is no long-lived secret to leak or rotate. One-time
# setup on PyPI:
#   pypi.org -> dash-mui-charts -> Publishing -> Add a new pending publisher
#     Owner:            pip-install-python
#     Repository:       dash-mui-charts
#     Workflow name:    release.yml
#     Environment name: pypi
#
# PyPI currently serves 1.2.3; 1.3.0 and 1.4.0 were built locally but never
# published. Cutting them is a release DECISION, made by pushing the tag —
# this workflow only makes the mechanics safe.
on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Build and verify, but publish to TestPyPI instead of PyPI"
        type: boolean
        default: true

jobs:
  verify:
    name: Verify the tag
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # check_release.py compares git commit times of the bundle and the
          # React source; a shallow clone turns that into a false skip.
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Tag must match the version in package.json
        # Catches the classic release mistake: bumping the code but tagging
        # the old number (or the reverse). PyPI would happily accept the
        # mismatch, and a PyPI filename can never be reused.
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PKG_VER=$(python -c "import json;print(json.load(open('package.json'))['version'])")
          echo "tag=$TAG  package.json=$PKG_VER"
          if [ "$TAG" != "$PKG_VER" ]; then
            echo "::error::Tag v$TAG does not match package.json version $PKG_VER"
            exit 1
          fi

      - name: Release consistency check
        run: python scripts/check_release.py

  build:
    name: Build distributions
    runs-on: ubuntu-latest
    needs: verify
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      # node makes the smoke test's JS syntax checks real — the committed
      # bundle is what ships in the wheel, and check_release has already
      # proven it fresh; no rebuild happens here.
      - uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Smoke test against the current Dash
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements.txt
          # markdown2dash pins gunicorn<22 against the CVE-driven gunicorn>=23
          # floor. Same two-command install as the Dockerfile, render service
          # and ci.yml — this was the one install site the M0 migration
          # missed, found when the 1.4.0 release build failed here.
          python -m pip install --no-deps markdown2dash==0.1.2
          python scripts/smoke_test.py

      - name: Build
        run: |
          python -m pip install build twine
          python -m build
          python -m twine check dist/*

      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    # The environment name must match the pending publisher configured on
    # PyPI. Add a required reviewer on this environment in repo settings for
    # a human approval gate between the tag and the upload.
    environment:
      name: pypi
      url: https://pypi.org/p/dash-mui-charts
    permissions:
      # `id-token: write` is what lets GitHub mint the OIDC token PyPI
      # checks. Without it trusted publishing fails with an opaque 403.
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish to TestPyPI (manual dry run)
        if: github.event_name == 'workflow_dispatch' && inputs.dry_run
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/

      - name: Publish to PyPI
        if: startsWith(github.ref, 'refs/tags/v')
        uses: pypa/gh-action-pypi-publish@release/v1

  github-release:
    name: GitHub Release
    needs: publish
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Extract this version's CHANGELOG section
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          awk -v v="$VERSION" '
            $0 ~ "^## \\[" v "\\]" {found=1; next}
            found && /^## \[/ {exit}
            found {print}
          ' CHANGELOG.md > release-notes.md
          if [ ! -s release-notes.md ]; then
            echo "See CHANGELOG.md for details." > release-notes.md
          fi
          cat release-notes.md

      - uses: softprops/action-gh-release@v2
        with:
          body_path: release-notes.md
          files: dist/*
          generate_release_notes: true