publish.yml

# Release pipeline — dogfoods the bundled patchnotes action for validation,
# tag/changelog sync, and GitHub Release creation, then publishes to PyPI
# via trusted publishing.
name: Publish to PyPI

on:
  push:
    tags: ["v*.*.*"]   # full version tags only — the moving 'v2' action tag doesn't match
  workflow_dispatch:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install . pytest
      - run: pytest tests/ -q

  release:
    name: Validate + GitHub Release (dogfood)
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      # On tag pushes: strict-validate, require tag == latest changelog
      # version, and publish a GitHub Release with the changelog notes.
      # On manual runs: validate + check against pyproject.toml only.
      - uses: ./
        with:
          file: CHANGELOG.md
          strict: "true"
          check-version: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || 'pyproject.toml' }}
          release: ${{ startsWith(github.ref, 'refs/tags/') && 'true' || 'false' }}
          version: "."

  publish:
    needs: release
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write   # required for PyPI trusted publishing
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Build sdist and wheel
        run: |
          pip install build
          python -m build
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1