release.yml

name: release

# A tag is the whole trigger. `git tag -a vX.Y.Z && git push origin vX.Y.Z`
# is the release procedure; everything below is what that tag is checked
# against before anything reaches the Releases page.
on:
  push:
    tags: ["v*"]

# Read by default. Each job asks for what it needs: `release` writes the
# Releases page, `publish` mints an OIDC token and writes nothing here.
permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: build and release ${{ github.ref_name }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          # The changelog check reads history no deeper than the working
          # tree, but `gh release create` wants the tag object itself.
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install 3.12

      - name: Install project
        run: |
          uv venv --python 3.12
          uv pip install -e ".[dev]"

      # Before the build, not after it: the three places a version is written
      # down have to agree, and the changelog entry has to exist.
      - name: Tag, package version and changelog agree
        run: uv run python tools/release_notes.py "${{ github.ref_name }}" --output notes.md

      # The full matrix already ran on the branch this tag points into. This
      # is the §12.3 acceptance subset, re-run against the tagged tree so a
      # tag placed on the wrong commit fails here rather than on someone's
      # machine.
      - name: Acceptance suite
        run: make acceptance PY="uv run python"

      - name: Build sdist and wheel
        run: uv build

      # An install from the artefact, not from the checkout: this is the only
      # step that proves the wheel a user gets is importable and reports the
      # version its tag claims.
      - name: Smoke-test the wheel
        run: |
          uv venv --python 3.12 /tmp/smoke
          VIRTUAL_ENV=/tmp/smoke uv pip install dist/*.whl
          reported="$(/tmp/smoke/bin/tlgr --version)"
          echo "$reported"
          case "$reported" in
            *"${GITHUB_REF_NAME#v}") ;;
            *) echo "wheel reports '$reported', tag is ${GITHUB_REF_NAME}" >&2; exit 1 ;;
          esac

      - name: Create the GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "${GITHUB_REF_NAME}" \
            --title "${GITHUB_REF_NAME}" \
            --notes-file notes.md \
            --verify-tag \
            dist/*

      # The same two files the release now carries, handed to the publish job
      # rather than rebuilt there: a wheel that was smoke-tested and a wheel
      # that reaches PyPI have to be the same bytes.
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  publish:
    name: publish ${{ github.ref_name }} to PyPI
    needs: release
    runs-on: ubuntu-latest
    # Trusted publishing: PyPI verifies this workflow's OIDC token against a
    # publisher configured for tlgrcli/tlgr, so there is no API token in the
    # repository to leak. The environment is the second gate — it is where a
    # required reviewer goes if this should ever stop being automatic.
    environment:
      name: pypi
      url: https://pypi.org/p/tlgr
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - uses: pypa/gh-action-pypi-publish@release/v1