release.yml

# Releases with release-please (configured in release-please-config.json).
#
# On every push to main, release-please opens or updates a release PR with the
# next version (pyproject.toml) and changelog, from the Conventional Commits since
# the last release. Merging it tags vX.Y.Z and creates the GitHub release; the
# publish job then checks, builds and uploads the package to PyPI.
#
# Publishing uses PyPI trusted publishing (OIDC): no PyPI token is stored in this
# repository. The project's trusted publisher on PyPI names this repository, this
# workflow file and the pypi environment.
#
# A release whose publish failed can be published again by hand: run this
# workflow with the release's tag. It publishes that tag and nothing else.
#
# Release PRs are opened with the default GITHUB_TOKEN, so CI waits for approval
# on them. They change only the version and the changelog, and the publish job
# runs the full checks before it uploads.
name: release

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      tag:
        description: An existing release tag to publish (vX.Y.Z)
        required: true

permissions:
  contents: read

jobs:
  release-please:
    name: Release PR
    runs-on: ubuntu-latest
    if: github.repository_owner == 'fells-code' && github.event_name == 'push'
    permissions:
      contents: write
      pull-requests: write
      issues: write
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - uses: googleapis/release-please-action@v5
        id: release
        with:
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

  publish:
    name: Publish to PyPI
    needs: release-please
    if: >-
      !cancelled() && github.repository_owner == 'fells-code' &&
      (needs.release-please.outputs.release_created == 'true' || github.event_name == 'workflow_dispatch')
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/seamless-auth/
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag || needs.release-please.outputs.tag_name }}
          persist-credentials: false
      - name: The tag is a release of this version
        env:
          TAG: ${{ inputs.tag || needs.release-please.outputs.tag_name }}
        run: |
          echo "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$' || { echo "not a release tag: $TAG"; exit 1; }
          git rev-parse -q --verify "refs/tags/$TAG" > /dev/null || { echo "no such tag: $TAG"; exit 1; }
          version=$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)
          [ "v$version" = "$TAG" ] || { echo "pyproject.toml says $version, tag is $TAG"; exit 1; }
      - uses: astral-sh/setup-uv@v10.2.0
        with:
          python-version: '3.13'
      - name: Checks
        # Frozen: the locked dependencies exactly, without checking the project's
        # own version in the lockfile, which a tag cut before release-please bumped
        # uv.lock (v0.1.0) still has as the previous one. CI holds main to --locked.
        run: |
          uv sync --frozen
          uv run ruff check .
          uv run mypy
          uv run pytest
      - run: uv build
      - uses: pypa/gh-action-pypi-publish@v1.14.2