switched the workflow to run on release branch push

.github/workflows/version-and-publish.yml → .github/workflows/validate-and-publish.yml

@@ -1,98 +1,75 @@
-name: Version and Publish
+name: Validate and Publish
 
 on:
-  workflow_dispatch: # allows manual invocation
-  push:
-    tags:
-      - "v*.*.*" # e.g. v1.2.3
+  pull_request:
+    types: [closed]
+    branches:
+      - main
 
 permissions:
   contents: write
   id-token: write
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
 jobs:
   build:
-    name: Build
+    if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/v')
     runs-on: ubuntu-latest
-
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    outputs:
+      version: ${{ steps.extract-version.outputs.version }}
     steps:
-      - name: Checkout repository
+      # https://github.com/actions/checkout
+      - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.repository.default_branch }}
 
-      - name: Setup Python
-        uses: ./.github/actions/setup-python
-
-      - name: Check for pending releases
+      - name: Extract and validate version from branch name
+        id: extract-version
         run: |
-          echo "Checking for pending changesets..."
-          CHANGES_STATUS=$(make changeset-status 2>&1)
-          echo "$CHANGES_STATUS"
-          if echo "$CHANGES_STATUS" | grep -qi "pending"; then
-            echo "Changesets found, continuing"
-          else
-            echo "No unreleased changesets found, exiting"
+          VERSION="${GITHUB_HEAD_REF#release/}"
+          if [[ ! "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Branch name does not match expected format release/vX.X.X (got: $GITHUB_HEAD_REF)"
             exit 1
           fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Extracted version: $VERSION"
+
+      - name: Setup Python
+        uses: ./.github/actions/setup-python
+        with:
+          python-version: ${{ matrix.python-version }}
 
       - name: Check formatting
         run: make format-check
 
       - name: Run type checking
         run: make typecheck
 
-  version-and-rebuild:
-    name: Version and Rebuild
+  prepare-release:
     runs-on: ubuntu-latest
     needs: build
-
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - name: Checkout repository
+      # https://github.com/actions/checkout
+      - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.repository.default_branch }}
 
       - name: Setup Python
         uses: ./.github/actions/setup-python
+        with:
+          python-version: ${{ matrix.python-version }}
 
-      - name: Configure Git User
-        run: |
-          git config user.name "tkhq-deploy"
-          git config user.email "github@turnkey.engineering"
-
-      - name: Create and switch to release branch
-        run: |
-          git fetch origin
-          git checkout -B release/${{ github.ref_name }} origin/release/${{ github.ref_name }} || \
-          git checkout -B release/${{ github.ref_name }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Version packages
-        run: |
-          make changeset-version
-          make changeset-changelog
-          make format-check
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Commit versioned changes
-        run: |
-          git add -A
-          git commit -m "chore: release packages" || echo "No changes to commit"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Push changes to release branch
-        run: |
-          git push -u origin release/${{ github.ref_name }}
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
+        with:
+          tag_name: ${{ needs.build.outputs.version }}
+          name: Release ${{ needs.build.outputs.version }}
+          generate_release_notes: true
+          draft: true
+          prerelease: false
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -102,52 +79,24 @@ jobs:
       - name: Upload release artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: release-artifacts-${{ github.ref_name }}
+          name: release-artifacts-${{ needs.build.outputs.version }}
           path: |
             packages/*/dist/
             .changeset/**
           retention-days: 7
 
-  prepare-release:
-    name: Prepare Release
-    runs-on: ubuntu-latest
-    needs: version-and-rebuild
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-          ref: release/${{ github.ref_name }}
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
-        with:
-          tag_name: ${{ github.ref_name }}
-          name: Release ${{ github.ref_name }}
-          generate_release_notes: true
-          draft: true
-          prerelease: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
   publish:
     name: Publish to PyPI
-    needs: prepare-release
+    needs: [build, prepare-release]
+    environment: production
     runs-on:
       group: package-deploy # environment: production # require manual approval for production deployments
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-          ref: release/${{ github.ref_name }}
-
       - name: Download release artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
-          name: release-artifacts-${{ github.ref_name }}
+          name: release-artifacts-${{ needs.build.outputs.version }}
           path: .
 
       - name: Prepare packages for publishing