release.yml

name: publish release

on:
  pull_request:
    types:
      - closed
    branches:
      - main

permissions: {}

# Serialize release PRs in FIFO order without letting no-op runs block them.
concurrency:
  group: ${{ github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/') && 'release' || format('release-noop-{0}', github.run_id) }}
  cancel-in-progress: false
  queue: max

jobs:
  build:
    name: Build and tag distributions
    if: >-
      github.event.pull_request.merged == true &&
      github.event.pull_request.base.ref == 'main' &&
      github.event.pull_request.head.repo.full_name == github.repository &&
      startsWith(github.event.pull_request.head.ref, 'release/')
    runs-on: ubuntu-latest
    outputs:
      release-version: ${{ steps.version.outputs.release-version }}
    permissions:
      contents: write
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          enable-cache: false

      - name: Read version
        id: version
        env:
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
        run: |
          release_version=$(uv version --short)
          release_tag="v$release_version"

          if test "$HEAD_REF" != "release/$release_tag"; then
            echo "$HEAD_REF does not match the version being released, $release_tag" >&2
            exit 1
          fi

          # Skip version-order validation when rerunning this tagged commit.
          if test "$(git rev-parse --verify --quiet "refs/tags/$release_tag^{commit}" || true)" != "$(git rev-parse HEAD)"; then
            release_tags=$(git tag --list 'v*')
            RELEASE_VERSION="$release_version" RELEASE_TAGS="$release_tags" uv run .github/scripts/check_release_version.py
          fi

          echo "RELEASE_VERSION=$release_version" >> "$GITHUB_ENV"
          echo "release-version=$release_version" >> "$GITHUB_OUTPUT"

      - name: Build distributions
        run: uv build

      # Let build-job reruns replace the previous artifact.
      - name: Upload distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: distributions
          path: dist/
          overwrite: true

      # Preserve a tag on this commit; a plain push rejects remote conflicts.
      - name: Push release tag
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag_commit=$(git rev-parse --verify --quiet "refs/tags/v$RELEASE_VERSION^{commit}" || true)
          if test "$tag_commit" != "$(git rev-parse HEAD)"; then
            git tag -f "v$RELEASE_VERSION"
          fi
          gh auth setup-git
          git push origin "refs/tags/v$RELEASE_VERSION"

  generate-provenance:
    name: Generate build provenance
    runs-on: ubuntu-latest
    needs: build
    permissions:
      id-token: write
      attestations: write
    steps:
      - name: Download distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: distributions
          path: dist/

      - name: Attest distributions
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: dist/*

  release:
    name: Create GitHub release
    runs-on: ubuntu-latest
    needs:
      - build
      - generate-provenance
    permissions:
      contents: write
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Download distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: distributions
          path: dist/

      # Release notes come from CHANGELOG.md so the release page and the repo
      # tell the same story. `--generate-notes` would list merged PRs instead.
      - name: Build release notes
        env:
          RELEASE_VERSION: ${{ needs.build.outputs.release-version }}
          COMPARE_URL: ${{ github.server_url }}/${{ github.repository }}/compare
        run: |
          awk -v version="$RELEASE_VERSION" '
            $0 == "## " version {found = 1; next}
            found && /^## / {exit}
            found {print}
          ' CHANGELOG.md >release-notes.md

          if ! grep -q '[^[:space:]]' release-notes.md; then
            echo "CHANGELOG.md has no entry for $RELEASE_VERSION" >&2
            exit 1
          fi

          previous_tag=$(git tag --list 'v*' --sort=-v:refname | grep -vxF "v$RELEASE_VERSION" | head -1)
          if test -n "$previous_tag"; then
            printf '\n**Full changelog**: %s/%s...v%s\n' \
              "$COMPARE_URL" "$previous_tag" "$RELEASE_VERSION" >>release-notes.md
          fi

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_VERSION: ${{ needs.build.outputs.release-version }}
        run: |
          # Keep existing release assets unchanged on reruns.
          if ! gh release view "v$RELEASE_VERSION" >/dev/null 2>&1; then
            gh release create "v$RELEASE_VERSION" dist/* \
              --title "v$RELEASE_VERSION" \
              --notes-file release-notes.md \
              --verify-tag
          fi

  publish:
    name: Publish distributions to PyPI
    runs-on: ubuntu-latest
    needs:
      - build
      - generate-provenance
      - release
    environment:
      name: pypi
      url: https://pypi.org/p/idac
    permissions:
      contents: read
      id-token: write
    steps:
      # Reuse release assets so partial PyPI uploads resume with identical bytes.
      - name: Download release assets
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_VERSION: ${{ needs.build.outputs.release-version }}
        run: gh release download "v$RELEASE_VERSION" --dir dist/

      - name: Publish distributions
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          attestations: true
          # Ignore files already published by a partial run.
          skip-existing: true