release-python.yml

name: release-python

on:
  push:
    tags: ["python-v*"]
    # Note: Python releases now use the 'python-v*' tag prefix to avoid
    # conflicting with Go sin-code releases which trigger on 'v*'.

permissions:
  contents: write     # required to create the GitHub Release + upload assets
  id-token: write     # required for PyPI Trusted Publishing (no API token needed)

jobs:
  build:
    name: build sdist + wheel
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Build distribution
        run: |
          python -m pip install --upgrade build
          python -m build
      - name: Verify wheel installs in a clean env
        run: |
          python -m venv /tmp/clean
          /tmp/clean/bin/pip install dist/*.whl
          /tmp/clean/bin/sin --help >/dev/null
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/*

  github-release:
    name: attach artifacts to GitHub Release
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          generate_release_notes: true

  pypi-publish:
    name: publish to PyPI (Trusted Publishing)
    needs: build
    runs-on: ubuntu-latest
    environment: pypi
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1