release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:

permissions: {}

# Thin caller: build, dist check, GitHub Release and PyPI upload all live in
# the shared reusable, so every pinned action version is maintained centrally
# in netresearch/.github. This workflow has zero step-level `uses:`.
#
# PyPI publishing is OFF, and that records a fact rather than making a policy
# choice: the token-based publish jobs this replaces could never have run.
# The repo has no Actions secrets at all, so PYPI_API_TOKEN and
# TEST_PYPI_API_TOKEN resolved to empty; there are no tags, no releases, and
# cli-audit is not registered on PyPI.
#
# Turning publishing on needs two things that cannot be done from a workflow
# file:
#   1. a PyPI Trusted Publisher configured for
#      netresearch/coding_agent_cli_toolset, pointing at this workflow and at
#      the environment named by the reusable's `pypi-environment` input,
#   2. that GitHub Environment (only `copilot` exists today).
# Then set publish-pypi: true. No token is required — the reusable uploads
# via OIDC Trusted Publishing.
jobs:
  release:
    uses: netresearch/.github/.github/workflows/python-release.yml@main
    permissions:
      contents: write
      id-token: write
    with:
      python-version: '3.14'
      package-manager: pip
      install-cmd: python -m pip install --upgrade pip build twine
      build-cmd: python -m build
      check-cmd: python -m twine check dist/*
      # Attach the sdist and wheel to the Release, as the previous
      # softprops/action-gh-release step did via `files: dist/*`.
      release-files: dist/*
      # Reproduces the previous prerelease expression and also covers the
      # PEP 440 spellings it missed. The project is on 2.0.0-alpha.6, so
      # prerelease tags are the normal case here, not the exception.
      prerelease: auto
      publish-pypi: false
      publish-testpypi: false