release.yml

name: Release

# Publishes to PyPI through Trusted Publishing (OIDC) — no API token is stored.
# Runs on version tags, or by hand from the Actions tab for the current main.

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: build sdist and wheel
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: astral-sh/setup-uv@v7

      - name: Tag matches pyproject version
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          tag="${GITHUB_REF_NAME#v}"
          version="$(python3 -c 'import tomllib; print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')"
          if [ "$tag" != "$version" ]; then
            echo "tag v$tag does not match pyproject version $version"; exit 1
          fi

      - name: Build
        run: uv build

      - name: Wheel installs and runs
        run: |
          uv venv /tmp/smoke
          uv pip install --python /tmp/smoke/bin/python dist/*.whl
          /tmp/smoke/bin/openmuse version
          /tmp/smoke/bin/openmuse config init --path /tmp/smoke/config.toml
          test -f /tmp/smoke/config.toml

      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  publish:
    name: publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/openmuse/
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/

      - uses: pypa/gh-action-pypi-publish@release/v1