release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag, for example v0.1.0"
        required: true
        type: string

permissions:
  contents: write
  id-token: write

jobs:
  validate-and-release:
    name: Validate, release, and publish
    runs-on: ubuntu-latest
    environment: pypi
    steps:
      - name: Check out repository
        shell: bash
        run: |
          git init .
          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
          git fetch --depth=1 origin "$GITHUB_SHA"
          git checkout --force FETCH_HEAD

      - name: Resolve tag
        shell: bash
        run: |
          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
            tag="${{ inputs.tag }}"
          else
            tag="${GITHUB_REF_NAME}"
          fi
          echo "RELEASE_TAG=$tag" >> "$GITHUB_ENV"

      - name: Validate release metadata
        shell: bash
        run: python scripts/verify_release.py "$RELEASE_TAG"

      - name: Run tests
        shell: bash
        run: |
          python -m pip install -e ".[dev]"
          python -m pytest

      - name: Build distributions
        shell: bash
        run: |
          python -m pip install --upgrade uv
          python -m uv build

      - name: Create GitHub release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          python - <<'PY'
          import json
          import os
          from pathlib import Path
          import urllib.error
          import urllib.request

          repo = os.environ["GITHUB_REPOSITORY"]
          tag = os.environ["RELEASE_TAG"]
          token = os.environ["GH_TOKEN"]
          version = tag.removeprefix("v")
          lines = Path("CHANGELOG.md").read_text(encoding="utf-8").splitlines()
          selected = []
          capture = False
          for line in lines:
              if line.startswith(f"## [{version}]"):
                  capture = True
                  continue
              if capture and line.startswith("## ["):
                  break
              if capture:
                  selected.append(line)
          body = "\n".join(selected).strip() or f"Release {tag}"
          url = f"https://api.github.com/repos/{repo}/releases"
          payload = {
              "tag_name": tag,
              "name": tag,
              "body": body,
              "draft": False,
              "prerelease": tag.startswith("v0."),
          }
          req = urllib.request.Request(
              url,
              data=json.dumps(payload).encode("utf-8"),
              headers={
                  "Accept": "application/vnd.github+json",
                  "Authorization": f"Bearer {token}",
                  "Content-Type": "application/json",
                  "X-GitHub-Api-Version": "2022-11-28",
              },
              method="POST",
          )
          try:
              with urllib.request.urlopen(req) as resp:
                  print(resp.read().decode("utf-8"))
          except urllib.error.HTTPError as exc:
              text = exc.read().decode("utf-8")
              if exc.code == 422 and "already_exists" in text:
                  print(f"Release already exists for {tag}")
              else:
                  raise
          PY

      - name: Publish to PyPI
        shell: bash
        run: python -m uv publish --trusted-publishing always dist/*