release.yml

name: Release

on:
  push:
    branches:
      - releases

permissions:
  contents: write
  id-token: write

jobs:
  release:
    name: Build and publish
    runs-on: ubuntu-latest
    environment: pypi

    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@v5

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version-file: .python-version

      - name: Sync packages
        run: uv sync --locked --all-packages

      - name: Resolve release version
        run: |
          python - <<'PY'
          import os
          import re
          import sys
          import tomllib
          from pathlib import Path

          with open("pyproject.toml", "rb") as file:
              version = tomllib.load(file)["project"]["version"]

          if not re.fullmatch(r"\d+\.\d+\.\d+((a|b|rc)\d+)?", version):
              print(f"Unsupported release version: {version!r}")
              print("Expected X.Y.Z, X.Y.ZaN, X.Y.ZbN, or X.Y.ZrcN.")
              sys.exit(1)

          tag = f"v{version}"
          github_env = Path(os.environ["GITHUB_ENV"])
          with github_env.open("a") as env:
              env.write(f"RELEASE_VERSION={version}\n")
              env.write(f"TAG_NAME={tag}\n")
          PY

      - name: Verify release tag is new
        run: |
          if git rev-parse --verify --quiet "refs/tags/$TAG_NAME"; then
              echo "Tag $TAG_NAME already exists."
              exit 1
          fi
          if git ls-remote --exit-code --tags origin "refs/tags/$TAG_NAME" >/dev/null 2>&1; then
              echo "Tag $TAG_NAME already exists on origin."
              exit 1
          fi

      - name: Check import sorting
        run: uv run ruff check --select I .

      - name: Check formatting
        run: uv run ruff format --check .

      - name: Type check package
        run: uv run basedpyright -p pyproject.toml

      - name: Contract tests
        run: uv run pytest tests/test_contracts.py -n auto

      - name: Build distributions
        run: uv build

      - name: Check distributions
        run: uv run twine check dist/*

      - name: Create release tag
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "$TAG_NAME" -m "Release $TAG_NAME" "$GITHUB_SHA"
          git push origin "$TAG_NAME"

      - name: Upload distributions
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/*
          if-no-files-found: error

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "$TAG_NAME" dist/* --generate-notes --title "$TAG_NAME"