cd.yml

name: Publish to PyPI

on:
  workflow_dispatch:

# Deny-by-default at workflow level; each job opts into exactly what it needs.
# Flagged by CodeQL `actions/missing-workflow-permissions`.
permissions:
  contents: read

concurrency:
  group: deploy
  cancel-in-progress: false

jobs:
  ci:
    uses: ./.github/workflows/ci.yml

  publish:
    needs: ci
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-tags: true

      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: pip
          cache-dependency-path: pyproject.toml

      - name: Extract version
        id: pkg
        run: |
          VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Publishing v$VERSION"

      - name: Version guard
        run: |
          if git rev-parse "v${{ steps.pkg.outputs.version }}" >/dev/null 2>&1; then
            echo "::error::Tag v${{ steps.pkg.outputs.version }} already exists. Bump the version first."
            exit 1
          fi

      - name: Build
        run: |
          python -m pip install --upgrade pip
          python -m pip install build
          python -m build

      - name: Generate SLSA build provenance attestation
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
        with:
          subject-path: 'dist/*'

      - name: Publish to PyPI
        # Floating `release/v1` is pypa's documented pin; the action self-updates within v1.
        # OIDC trusted publishing — configure at:
        # https://pypi.org/manage/project/my-mcp-server/settings/publishing/
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          attestations: true

      - name: Create GitHub Release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
        with:
          tag_name: v${{ steps.pkg.outputs.version }}
          name: v${{ steps.pkg.outputs.version }}
          generate_release_notes: true