cd.yaml

name: CD

on:
  push:
    tags:
      - '*'

permissions:
  contents: read

jobs:
  validate-tag:
    name: Validate release tag
    runs-on: ubuntu-latest
    outputs:
      release_tag: ${{ steps.validate.outputs.release_tag }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: '3.12'
      - name: Validate tag and package version
        id: validate
        run: |
          python - <<'PY'
          import os
          import re
          import tomllib
          from pathlib import Path

          tag = os.environ["GITHUB_REF_NAME"]
          version = tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"]
          is_release = re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", tag) is not None
          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
              print(f"release_tag={str(is_release).lower()}", file=output)
          if not is_release:
              print(f"Tag {tag!r} is not a PyPI release tag; skipping publish.")
              raise SystemExit(0)
          if version != tag:
              raise SystemExit(f"pyproject version {version!r} does not match tag {tag!r}")
          print(f"Release version verified: {version}")
          PY

  build:
    name: Build distribution
    needs: validate-tag
    if: needs.validate-tag.outputs.release_tag == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: '3.12'
          cache: pip
      - name: Install build tools
        run: python -m pip install build twine
      - name: Build package
        run: python -m build
      - name: Check distribution metadata
        run: python -m twine check dist/*
      - name: Upload distribution artifact
        uses: actions/upload-artifact@v7
        with:
          name: python-distribution
          path: dist/*
          if-no-files-found: error

  publish-pypi:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Download distribution artifact
        uses: actions/download-artifact@v8
        with:
          name: python-distribution
          path: dist
      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1