publish.yml

name: Publish to PyPI

# Publishes compartment to PyPI automatically whenever a GitHub
# Release is published. Uses PyPI Trusted Publishing (OIDC) - no API token
# is stored anywhere. One-time setup on PyPI: project compartment ->
# Manage -> Publishing -> add a GitHub publisher (owner MaxFreedomPollard,
# repo Compartment, workflow publish.yml, environment pypi).

on:
  release:
    types: [published]
  # Both uploads use skip-existing, so a manual run is safe: it re-publishes
  # nothing that is already on PyPI. Useful when a publisher was fixed after a
  # release, or when only the tombstone still needs to go out.
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-and-publish:
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write        # required for Trusted Publishing (OIDC)
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Build wheel + sdist
        run: |
          python -m pip install --upgrade build
          python -m build

      - name: Check metadata
        run: |
          python -m pip install --upgrade twine
          python -m twine check dist/*

      - name: Publish to PyPI (Trusted Publishing)
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true   # a re-run for an already-uploaded version is a no-op, not a failure

  # The old distribution name, kept alive as a tombstone that just depends on
  # compartment. PyPI names cannot be deleted or redirected, so leaving
  # engram-memory-vault frozen at 1.14.0 would silently strand everyone who
  # installed it before the rename.
  #
  # This is a second PyPI project, so it needs its own trusted publisher on
  # PyPI - same owner, repo, workflow and environment as the one above, just
  # registered against engram-memory-vault.
  publish-tombstone:
    runs-on: ubuntu-latest
    needs: build-and-publish        # never orphan the name it points at
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Build the tombstone
        working-directory: packaging/engram-memory-vault
        run: |
          python -m pip install --upgrade build twine
          python -m build --outdir dist
          python -m twine check dist/*

      - name: Publish the tombstone to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: packaging/engram-memory-vault/dist
          skip-existing: true   # only the first release of a given version uploads