release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: Validate, test, and build
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Set up uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          enable-cache: true

      - name: Validate release tag
        shell: bash
        run: |
          set -euo pipefail

          if [[ ! "$GITHUB_REF_NAME" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
            echo "Tag must use stable semantic version format: vMAJOR.MINOR.PATCH"
            exit 1
          fi

          tag_version="${GITHUB_REF_NAME#v}"
          project_version="$(
            python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])"
          )"
          if [[ "$tag_version" != "$project_version" ]]; then
            echo "Tag version $tag_version does not match pyproject.toml version $project_version"
            exit 1
          fi

          git fetch origin main
          tagged_commit="$(git rev-list -n 1 "$GITHUB_REF_NAME")"
          if ! git merge-base --is-ancestor "$tagged_commit" origin/main; then
            echo "Tagged commit $tagged_commit is not contained in origin/main"
            exit 1
          fi

      - name: Install dependencies
        run: uv sync --locked --extra dev

      - name: Run tests
        run: uv run pytest

      - name: Build distributions
        run: uv build

      - name: Check distribution metadata
        run: uvx twine check dist/*

      - name: Smoke-test wheel installation
        shell: bash
        run: |
          set -euo pipefail
          uv venv .release-venv
          uv pip install --python .release-venv/bin/python dist/*.whl
          .release-venv/bin/python -c "import fp; print(fp.__file__)"

      - name: Upload distributions
        uses: actions/upload-artifact@v7
        with:
          name: python-distributions
          path: dist/
          if-no-files-found: error

  publish:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/foundation-protocol/
    permissions:
      id-token: write

    steps:
      - name: Download distributions
        uses: actions/download-artifact@v8
        with:
          name: python-distributions
          path: dist/

      - name: Publish distributions
        uses: pypa/gh-action-pypi-publish@v1.14.0

  release:
    name: Create GitHub Release
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Download distributions
        uses: actions/download-artifact@v8
        with:
          name: python-distributions
          path: dist/

      - name: Create release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "$GITHUB_REF_NAME" dist/* --generate-notes --verify-tag