release.yml

name: Release

on:
  push:
    tags: ["v[0-9]*"]
  workflow_dispatch:

jobs:
  # Run the full test suite before releasing.
  tests:
    uses: ./.github/workflows/tests.yml

  build:
    needs: [tests]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Set up uv
        uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
      - name: Build sdist and wheel
        run: uv build
      - name: Check distributions
        run: uvx twine check dist/*
      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/

  # Dry run: manually trigger the workflow (Actions -> Release -> Run workflow)
  # to publish to TestPyPI and confirm the package installs before tagging a real
  # release. Requires a `testpypi` environment + a TestPyPI trusted publisher.
  publish-testpypi:
    needs: [build]
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    environment:
      name: testpypi
      url: https://test.pypi.org/p/moderndive
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/
      - name: Publish to TestPyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/

  # Real release: only on a pushed v* tag.
  publish:
    needs: [build]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    # Trusted publishing to PyPI via OIDC (configure the publisher on PyPI and
    # create a `pypi` environment in the repo settings).
    environment:
      name: pypi
      url: https://pypi.org/p/moderndive
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1