release.yml

name: Release
# One tag publishes one version to PyPI, by trusted publishing: PyPI accepts the pypi job's OIDC identity, so no
# token is stored anywhere. PyPI checks that identity against this file's name and the `pypi` environment.
#
# Once PyPI has it, the github job creates the GitHub release with the built files attached.
#
# Run by hand, it builds and stops, publishing nothing.
on:
  push:
    tags: ["v*"]
  workflow_dispatch:
permissions: {}
defaults:
  run:
    shell: bash
jobs:
  build:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
    steps:
      - uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          python-version: "3.12"
          enable-cache: false
      # A tag that disagrees with the package version would publish one number under another's name.
      - if: github.event_name == 'push'
        run: test "v$(uv version --short)" = "$GITHUB_REF_NAME"
      # PyPI never takes a version back, so only a commit already on main is published.
      - if: github.event_name == 'push'
        run: git merge-base --is-ancestor "$GITHUB_SHA" origin/main
      - run: uv build
      # Import the wheel alone, outside the checkout, so a file missing from it fails here and not for users.
      - run: uv run --isolated --no-project --with dist/*.whl python -c "import zero_server"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: dist
          path: dist/

  pypi:
    needs: build
    if: github.event_name == 'push'
    runs-on: blacksmith-4vcpu-ubuntu-2404
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1

  # Only after PyPI accepts the version, so a release on GitHub always names one users can install.
  github:
    needs: pypi
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: dist
          path: dist/
      - run: gh release create "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --verify-tag --generate-notes --title "$GITHUB_REF_NAME"
        env:
          GH_TOKEN: ${{ github.token }}