release.yml

name: Release

on:
  push:
    branches: [master]

jobs:
  run_tests:
    uses: ./.github/workflows/ci.yml

  release:
    runs-on: ubuntu-latest
    needs: run_tests
    if: github.ref_name == 'master'
    concurrency:
      group: ${{ github.workflow }}-release-${{ github.ref_name }}
      cancel-in-progress: false
    permissions:
      contents: write
    outputs:
      released: ${{ steps.release.outputs.released || 'false' }}
      version: ${{ steps.release.outputs.version }}

    steps:
    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        ref: ${{ github.ref_name }}
        fetch-depth: 0

    - run: git reset --hard ${{ github.sha }}

    - name: Python Semantic Release
      id: release
      uses: python-semantic-release/python-semantic-release@v10.5.3
      with:
        github_token: ${{ secrets.OPENEDX_SEMANTIC_RELEASE_GITHUB_TOKEN }}
        git_committer_name: "github-actions"
        git_committer_email: "github-actions@github.com"
        changelog: "false"

    - name: Publish | Upload to GitHub Release Assets
      uses: python-semantic-release/publish-action@v10.5.3
      if: steps.release.outputs.released == 'true'
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        tag: ${{ steps.release.outputs.tag }}

    - name: Upload dist artifacts
      if: steps.release.outputs.released == 'true'
      uses: actions/upload-artifact@v7
      with:
        name: dist
        path: dist/

  publish_to_pypi:
    runs-on: ubuntu-latest
    needs: release
    if: needs.release.outputs.released == 'true'
    permissions:
      id-token: write

    steps:
    - name: Download dist artifacts
      uses: actions/download-artifact@v8
      with:
        name: dist
        path: dist/

    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1