release.yml

# Publish to PyPI on a version tag, via PyPI Trusted Publishing (OIDC) — no API
# token stored anywhere. The published version is whatever pyproject.toml says;
# the tag (v0.1.0, ...) is just the trigger — and is checked against it below.
# Bump pyproject.toml's version and _version.py to match before tagging.
#
# One-time PyPI setup (Trusted Publisher / "pending publisher" for a new project):
#   PyPI Project Name: isms-sdk
#   Owner:             unidoc
#   Repository name:   isms-python
#   Workflow name:     release.yml
#   Environment name:  pypi
name: release

on:
  push:
    tags: ["v*"]

permissions:
  contents: read

jobs:
  # tests.yml only runs on push-to-master / PRs, never on tag pushes — so gate the
  # release on lint+tests passing on this exact tagged commit.
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - run: pip install --quiet -e ".[dev]"
      - run: ruff check src tests
      - run: pytest -q

  publish:
    needs: test
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write   # required for PyPI Trusted Publishing (OIDC)
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - name: Verify tag matches project version
        run: |
          tag_version="${GITHUB_REF_NAME#v}"
          project_version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')"
          if [ "$tag_version" != "$project_version" ]; then
            echo "::error::Tag v$tag_version does not match pyproject.toml version $project_version"
            exit 1
          fi
      - name: Build sdist + wheel
        run: |
          python -m pip install --quiet build
          python -m build
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1