python-publish.yml

# Publish to PyPI on every push to main.
# The "Check if version exists" step makes this idempotent — if the version
# is already on PyPI, the job skips the publish cleanly.

name: Publish to PyPI

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: publish-pypi
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write  # required for trusted publishing

    environment:
      name: pypi
      url: https://pypi.org/p/desloppify

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Get version from pyproject.toml
        id: version
        run: |
          VERSION=$(python -c "import tomllib; print(tomllib.loads(open('pyproject.toml').read())['project']['version'])")
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Check if version exists on PyPI
        id: check
        run: |
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/desloppify/${{ steps.version.outputs.version }}/json")
          if [ "$STATUS" = "200" ]; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "Version ${{ steps.version.outputs.version }} already on PyPI — skipping publish."
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
            echo "Version ${{ steps.version.outputs.version }} not on PyPI — will publish."
          fi

      - name: Run packaging smoke gate
        if: steps.check.outputs.exists == 'false'
        run: make package-smoke

      - name: Publish to PyPI
        if: steps.check.outputs.exists == 'false'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/