publish.yml

name: Publish to PyPI

# Triggers when a new tag matching v* is pushed (e.g. `git push --follow-tags`).
# Uses OIDC trusted publishing — no API tokens stored as repo secrets, no key
# rotation, no exfiltration risk if the workflow is ever compromised.
#
# One-time setup on PyPI (see docs/PYPI_PUBLISHING.md):
#   1. Create PyPI account → 2FA → email-verified.
#   2. Visit https://pypi.org/manage/account/publishing/
#   3. Add a Pending publisher:
#        PyPI Project Name : falsify-eval
#        Owner             : spalsh-spec
#        Repository name   : falsify-eval
#        Workflow filename : publish.yml
#        Environment name  : pypi
#   4. After the first successful publish, the pending publisher becomes
#      a permanent trusted publisher.

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: Build sdist + wheel
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install build deps
        run: python -m pip install --upgrade pip build twine

      - name: Build
        run: python -m build

      - name: Validate metadata
        run: python -m twine check dist/*

      - name: Verify version matches tag
        # Read versions from source files directly so this step works without
        # the package being installed in this environment. Catches:
        #   - tag/__init__.py drift
        #   - tag/pyproject.toml drift
        #   - __init__.py/pyproject.toml drift (the same check
        #     test_d7_version_sync runs in pytest)
        run: |
          set -e
          TAG="${GITHUB_REF#refs/tags/v}"
          INIT_VERSION=$(grep -E '^__version__\s*=' falsify_eval/__init__.py | sed -E 's/.*"([^"]+)".*/\1/')
          PYPROJECT_VERSION=$(grep -E '^version\s*=' pyproject.toml | sed -E 's/.*"([^"]+)".*/\1/')
          echo "tag           = $TAG"
          echo "__init__.py   = $INIT_VERSION"
          echo "pyproject.toml = $PYPROJECT_VERSION"
          if [ "$TAG" != "$INIT_VERSION" ] || [ "$TAG" != "$PYPROJECT_VERSION" ]; then
            echo "::error::version mismatch — tag/init/pyproject must all agree"
            exit 1
          fi
          echo "all three agree on $TAG ✓"

      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish-pypi:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/falsify-eval
    permissions:
      # Required for OIDC trusted publishing. No API token needed.
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish via OIDC
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          # No `password:` field — trusted publisher OIDC auth instead.
          packages-dir: dist/
          verify-metadata: true
          skip-existing: false