python-publish.yaml

name: Release and Publish

on:
  pull_request:
    types: [closed]
    branches: [main]

concurrency:
  group: release-${{ github.repository }}
  cancel-in-progress: false

jobs:
  prepare:
    if: >
      github.event.pull_request.merged == true &&
      startsWith(github.event.pull_request.head.ref, 'release/v')
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.VERSION }}
      prerelease: ${{ steps.version.outputs.PRERELEASE }}
      changelog: ${{ steps.changelog.outputs.CONTENT }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Extract version from branch name
        id: version
        env:
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
        run: |
          VERSION=${HEAD_REF#release/v}
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          if echo "$VERSION" | grep -qE "(rc|alpha|beta)[0-9]+$"; then
            echo "PRERELEASE=true" >> $GITHUB_OUTPUT
          else
            echo "PRERELEASE=false" >> $GITHUB_OUTPUT
          fi

      - name: Validate version matches pyproject.toml
        env:
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          PYPROJECT_VERSION=$(grep '^version = ' sdk/pyproject.toml | sed 's/version = "\(.*\)"/\1/')
          if [ "$VERSION" != "$PYPROJECT_VERSION" ]; then
            echo "::error::Version mismatch: branch=$VERSION, pyproject.toml=$PYPROJECT_VERSION"
            exit 1
          fi

      - name: Extract changelog
        id: changelog
        env:
          VERSION: ${{ steps.version.outputs.VERSION }}
          PRERELEASE: ${{ steps.version.outputs.PRERELEASE }}
        run: |
          if [ "$PRERELEASE" = "true" ]; then
            echo "CONTENT=Pre-release version $VERSION" >> $GITHUB_OUTPUT
          else
            CONTENT=$(sed -n "/## \[$VERSION\]/,/## \[/p" sdk/CHANGELOG.md | tail -n +2 | head -n -1)
            DELIMITER=$(openssl rand -hex 8)
            echo "CONTENT<<${DELIMITER}" >> $GITHUB_OUTPUT
            echo "$CONTENT" >> $GITHUB_OUTPUT
            echo "${DELIMITER}" >> $GITHUB_OUTPUT
          fi

  build-and-test:
    needs: prepare
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: '3.11'

      - name: Install build tools
        run: pip install build

      - name: Build distributions
        run: python -m build sdk/

      - name: Upload distributions
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: release-dists
          path: sdk/dist/
          retention-days: 7

  create-tag:
    needs: [prepare, build-and-test]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Create and push tag
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          TAG="v$VERSION"
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            echo "Tag $TAG already exists, skipping."
            exit 0
          fi
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "$TAG" -m "Release $TAG"
          git push origin "$TAG"

  pypi-publish:
    needs: [prepare, build-and-test, create-tag]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    environment:
      name: pypi
      url: https://pypi.org/p/eggai

    steps:
      - name: Check if already published
        id: check
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://pypi.org/pypi/eggai/$VERSION/json)
          echo "exists=$([ "$STATUS" = "200" ] && echo true || echo false)" >> $GITHUB_OUTPUT

      - name: Download distributions
        if: steps.check.outputs.exists == 'false'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: release-dists
          path: dist/

      - name: Publish to PyPI
        if: steps.check.outputs.exists == 'false'
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1

  github-release:
    needs: [prepare, build-and-test, create-tag]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Download distributions
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: release-dists
          path: dist/

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.prepare.outputs.version }}
          PRERELEASE: ${{ needs.prepare.outputs.prerelease }}
          CHANGELOG_BODY: ${{ needs.prepare.outputs.changelog }}
        run: |
          if gh release view "v$VERSION" > /dev/null 2>&1; then
            echo "Release v$VERSION already exists, uploading artifacts."
            gh release upload "v$VERSION" dist/* --clobber
          else
            PRERELEASE_FLAG=""
            if [ "$PRERELEASE" = "true" ]; then
              PRERELEASE_FLAG="--prerelease"
            fi
            printf '%s\n' "## What's Changed" "" "$CHANGELOG_BODY" "" "## Installation" "" '```bash' "pip install eggai==$VERSION" '```' > /tmp/notes.md
            gh release create "v$VERSION" dist/* \
              --title "v$VERSION" \
              --notes-file /tmp/notes.md \
              $PRERELEASE_FLAG
          fi

  notify-failure:
    needs: [prepare, build-and-test, create-tag, pypi-publish, github-release]
    if: failure()
    runs-on: ubuntu-latest
    permissions:
      issues: write

    steps:
      - name: Create failure issue
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          gh issue create \
            --repo "$GITHUB_REPOSITORY" \
            --title "Release v$VERSION failed" \
            --body "Workflow run: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
            --label "bug"