release.yml

name: Release

on:
  release:
    types:
      - published
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  tests:
    name: Release tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13"]

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e .[dev]

      - name: Run tests
        run: python -m pytest

  quality:
    name: Release quality checks
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e .[dev]

      - name: Run Ruff
        run: python -m ruff check .

      - name: Run mypy
        run: python -m mypy glpi_python_client

      - name: Build documentation
        run: python -m sphinx -W --keep-going -b html docs docs/_build/html

  build:
    name: Build distributions
    needs:
      - tests
      - quality
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e .[dev]

      - name: Validate release tag matches package version
        if: github.event_name == 'release'
        shell: bash
        run: |
          set -euo pipefail

          release_tag="${{ github.event.release.tag_name }}"
          normalized_tag="${release_tag#v}"
          pyproject_version="$(python - <<'PY'
          from pathlib import Path
          try:
              from tomllib import loads as toml_loads
          except ModuleNotFoundError:
              from tomli import loads as toml_loads

          pyproject = toml_loads(Path('pyproject.toml').read_text(encoding='utf-8'))
          print(pyproject['project']['version'])
          PY
          )"
          package_version="$(python - <<'PY'
          import glpi_python_client
          print(glpi_python_client.__version__)
          PY
          )"

          if [ "${pyproject_version}" != "${package_version}" ]; then
            echo "pyproject.toml version (${pyproject_version}) does not match glpi_python_client.__version__ (${package_version})." >&2
            exit 1
          fi

          if [ "${normalized_tag}" != "${pyproject_version}" ]; then
            echo "GitHub release tag (${release_tag}) does not match package version (${pyproject_version})." >&2
            exit 1
          fi

      - name: Build distributions
        run: python -m build

      - name: Check distribution metadata
        run: python -m twine check dist/*

      - name: Upload distributions
        uses: actions/upload-artifact@v4
        with:
          name: glpi-python-client-dist
          path: dist/*

  publish-pypi:
    name: Upload release to PyPI
    if: github.event_name == 'release'
    needs:
      - build
    runs-on: ubuntu-latest
    # Specifying a GitHub environment is optional, but strongly encouraged.
    environment:
      name: pypi
      url: https://pypi.org/project/glpi-python-client/
    permissions:
      # IMPORTANT: this permission is mandatory for Trusted Publishing.
      id-token: write

    steps:
      - name: Download distributions
        uses: actions/download-artifact@v4
        with:
          name: glpi-python-client-dist
          path: dist

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/

  publish-readthedocs:
    name: Publish release docs
    if: ${{ always() && needs.build.result == 'success' && (github.event_name != 'release' || needs.publish-pypi.result == 'success') }}
    needs:
      - build
      - publish-pypi
    runs-on: ubuntu-latest
    env:
      READTHEDOCS_BASE_URL: ${{ vars.READTHEDOCS_BASE_URL }}
      READTHEDOCS_PROJECT: ${{ secrets.READTHEDOCS_PROJECT }}
      READTHEDOCS_TOKEN: ${{ secrets.READTHEDOCS_TOKEN }}
      READTHEDOCS_VERSION: ${{ vars.READTHEDOCS_RELEASE_VERSION }}

    steps:
      - name: Sync versions and trigger Read the Docs release build
        shell: bash
        run: |
          set -euo pipefail
          if [ -z "${READTHEDOCS_TOKEN:-}" ] || [ -z "${READTHEDOCS_PROJECT:-}" ]; then
            echo "Read the Docs secrets are not configured; skipping release build."
            exit 0
          fi

          base_url="${READTHEDOCS_BASE_URL:-https://app.readthedocs.org}"
          version="${READTHEDOCS_VERSION:-stable}"

          curl --fail --silent --show-error --location \
            --request POST \
            --header "Authorization: Token ${READTHEDOCS_TOKEN}" \
            "${base_url}/api/v3/projects/${READTHEDOCS_PROJECT}/sync-versions/"

          curl --fail --silent --show-error --location \
            --request POST \
            --header "Authorization: Token ${READTHEDOCS_TOKEN}" \
            "${base_url}/api/v3/projects/${READTHEDOCS_PROJECT}/versions/${version}/builds/"