publish.yml

name: 🚀 Publish Release
on:
  workflow_run:
    workflows: ["⚙️ Test"]
    branches:
      - main
    types:
      - completed

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  release-build:
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      should_publish: ${{ steps.check.outputs.should_publish }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        name: ⬇️ Checkout repository
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        name: 📦 Setup Python
        with:
          python-version: "3.11"
          cache: "pip"
      - name: 🔢 Read version
        id: version
        run: |
          VERSION=$(python -c "import tomllib; print(tomllib.loads(open('pyproject.toml','rb').read().decode())['project']['version'])")
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
      - name: 🔎 Check if already published
        id: check
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          if curl -fsSL "https://pypi.org/pypi/geothai/${VERSION}/json" >/dev/null 2>&1; then
            echo "should_publish=false" >> "$GITHUB_OUTPUT"
            echo "ℹ️ geothai ${VERSION} already on PyPI; skipping publish."
          else
            echo "should_publish=true" >> "$GITHUB_OUTPUT"
          fi
      - name: 🔍 Install dependencies
        if: steps.check.outputs.should_publish == 'true'
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
      - name: 🏗 Build release
        if: steps.check.outputs.should_publish == 'true'
        run: python -m build
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: steps.check.outputs.should_publish == 'true'
        name: 📤 Upload artifact
        with:
          name: release
          path: dist/

  pypi-publish:
    if: needs.release-build.outputs.should_publish == 'true'
    runs-on: ubuntu-latest
    needs:
      - release-build
    permissions:
      id-token: write
    environment:
      name: pypi
      url: https://pypi.org/project/geothai
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        name: 📥 Download artifact
        with:
          name: release
          path: dist/
      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        name: 🚀 Publish package

  github-release:
    if: needs.release-build.outputs.should_publish == 'true'
    runs-on: ubuntu-latest
    needs:
      - release-build
      - pypi-publish
    permissions:
      contents: write
      id-token: write
    env:
      VERSION: ${{ needs.release-build.outputs.version }}
      GITHUB_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        name: ⬇️ Checkout repository
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        name: 📥 Download artifact
        with:
          name: release
          path: dist/
      - uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
        name: 🔑 Sign artifact
        with:
          inputs: dist/*
      - name: 🏷  Tag commit
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if ! git rev-parse "v${VERSION}" >/dev/null 2>&1; then
            git tag "v${VERSION}"
            git push origin "v${VERSION}"
          fi
      - name: 🚀 Create Release
        run: gh release create "v${VERSION}" --repo "${GITHUB_REPOSITORY}" --generate-notes
      - name: 📦 Upload Release Asset
        run: gh release upload "v${VERSION}" dist/* --repo "${GITHUB_REPOSITORY}"