release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: Validate and build
    runs-on: ubuntu-latest
    steps:
      - name: Check out tagged source
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install uv
        uses: astral-sh/setup-uv@v10.0.1
        with:
          enable-cache: true
          cache-dependency-glob: uv.lock

      - name: Install locked workspace and all advertised extras
        run: uv sync --locked --all-packages --all-extras --all-groups

      - name: Verify public tree
        run: python scripts/check_public_tree.py

      - name: Verify tag and package versions
        run: python scripts/check_versions.py --tag "${{ github.ref_name }}"

      - name: Run release test suite
        run: >-
          uv run pytest
          -m "not live_provider and not slow"
          -q

      - name: Build distributions
        shell: bash
        run: |
          set -euo pipefail
          rm -rf dist
          mkdir -p dist/packages
          uv build --package akms --out-dir dist/packages
          uv build --package akms-learn --out-dir dist/packages
          uv build --package akms-nodes-gen --out-dir dist/packages
          uv build --package akms-failure-memory --out-dir dist/packages
          uv build --package compmech-reference-pack --out-dir dist/packages
          uv run --with twine twine check dist/packages/*
          sha256sum dist/packages/* > dist/SHA256SUMS

      - name: Clean-install minimal core wheel
        shell: bash
        run: |
          set -euo pipefail
          uv venv .venv-core-release --python 3.12
          uv pip install --python .venv-core-release/bin/python \
            dist/packages/akms-*.whl pytest
          .venv-core-release/bin/python -m pytest tests/public_smoke/core -q

      - name: Clean-install complete embedded runtime
        shell: bash
        run: |
          set -euo pipefail
          uv venv .venv-release --python 3.12
          AKMS_URI=$(python - <<'PY'
          from pathlib import Path
          print(next(Path('dist/packages').glob('akms-*.whl')).resolve().as_uri())
          PY
          )
          uv pip install --python .venv-release/bin/python \
            "akms[orchestration] @ ${AKMS_URI}" \
            dist/packages/akms_learn-*.whl \
            dist/packages/akms_nodes_gen-*.whl \
            dist/packages/akms_failure_memory-*.whl \
            pytest
          .venv-release/bin/python -c \
            "from akms.orchestrator import run_pipeline; print('embedded runtime import: OK')"
          .venv-release/bin/python -m pytest tests/public_smoke/runtime -q

      - name: Hand the verified distributions to the publish jobs
        uses: actions/upload-artifact@v7.0.1
        with:
          name: distributions
          path: dist
          if-no-files-found: error
          retention-days: 7

  # One publish job per package, each in its own environment.
  #
  # PyPI enforces uniqueness on the (owner, repository, workflow, environment)
  # tuple for *pending* publishers, so four packages released from one repo by
  # one workflow cannot share a single environment — only the first of them can
  # be registered. A job may declare exactly one environment, so the publish
  # step has to fan out rather than upload all four from one job.
  #
  # This is the better shape on its own terms anyway: each package's OIDC token
  # is scoped to an environment that can publish that package and nothing else.
  publish:
    name: Publish ${{ matrix.package }} to PyPI
    if: vars.PUBLISH_TO_PYPI == 'true'
    needs: build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    environment:
      name: pypi-${{ matrix.package }}
      url: https://pypi.org/p/${{ matrix.package }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - package: akms
            prefix: "akms-"
          - package: akms-learn
            prefix: "akms_learn-"
          - package: akms-nodes-gen
            prefix: "akms_nodes_gen-"
          - package: akms-failure-memory
            prefix: "akms_failure_memory-"
          - package: compmech-reference-pack
            prefix: "compmech_reference_pack-"
    steps:
      - name: Download the verified distributions
        uses: actions/download-artifact@v8.0.1
        with:
          name: distributions
          path: dist

      - name: Isolate this package's distributions
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p upload
          cp dist/packages/${{ matrix.prefix }}* upload/
          # Exactly one wheel and one sdist. A prefix that silently matched
          # nothing would publish an empty directory, and one that over-matched
          # would push a sibling package into the wrong project. Both are quiet
          # failures worth making loud.
          found=$(find upload -type f | wc -l | tr -d ' ')
          if [ "$found" -ne 2 ]; then
            echo "expected 2 distributions for ${{ matrix.package }}, found ${found}:" >&2
            find upload -type f >&2
            exit 1
          fi
          ls -l upload

      - name: Publish through trusted publishing
        uses: pypa/gh-action-pypi-publish@v1.14.2
        with:
          packages-dir: upload/
          verbose: true
          # Makes a re-run idempotent. PyPI caps how many *pending* publishers
          # one account may hold, which is fewer than the four projects here,
          # so the first release has to publish in waves: register what fits,
          # publish (which converts those pending publishers into normal ones
          # and frees the slots), register the rest, run again. Without this,
          # the second run fails on the packages the first one already
          # uploaded. It also makes recovery from a partial upload — a network
          # failure part-way through the matrix — a re-run rather than a
          # version bump.
          #
          # This cannot overwrite anything: PyPI rejects a duplicate filename
          # whatever its contents, and the flag only swallows that rejection.
          skip-existing: true

  github-release:
    name: Create GitHub release
    needs: [build, publish]
    # `publish` is skipped whenever PUBLISH_TO_PYPI is unset, and a skipped
    # dependency would otherwise skip this job too. Run whenever the build
    # succeeded and nothing actually failed, so a validation-only tag still
    # cuts the release — but never publish a release after a failed upload.
    if: >-
      always()
      && needs.build.result == 'success'
      && !contains(needs.*.result, 'failure')
      && !contains(needs.*.result, 'cancelled')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download the verified distributions
        uses: actions/download-artifact@v8.0.1
        with:
          name: distributions
          path: dist

      - name: Create GitHub release
        uses: softprops/action-gh-release@v3
        with:
          generate_release_notes: true
          fail_on_unmatched_files: true
          files: |
            dist/packages/*
            dist/SHA256SUMS