release.yml

name: Release (PyPI + GitHub)

on:
  push:
    tags:
      - "v*.*.*"

# Needed for:
# - PyPI Trusted Publisher (OIDC): id-token: write
# - Creating GitHub Releases: contents: write
permissions:
  contents: write
  id-token: write

jobs:
  validate-build:
    name: Validate + Test + Build
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python 3.10
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"
          cache: pip

      - name: Install dependencies
        run: |
          set -euo pipefail
          python -m pip install --upgrade pip
          pip install -r requirements_dev.txt
          pip install build

      - name: Validate tag version matches setup.py
        run: |
          set -euo pipefail
          python - <<'PY'
          from __future__ import annotations

          import os
          import re
          from pathlib import Path

          tag = os.environ.get("GITHUB_REF_NAME", "")
          if not tag.startswith("v"):
            raise SystemExit(f"Expected tag like vX.Y.Z, got {tag!r}")
          version = tag.removeprefix("v")

          setup_text = Path("setup.py").read_text(encoding="utf-8")
          m = re.search(r"version\s*=\s*['\"]([^'\"]+)['\"]", setup_text)
          setup_version = m.group(1) if m else None
          if setup_version != version:
            raise SystemExit(f"Tag version {version} != setup.py version {setup_version}")

          print(f"OK: tag={tag} setup.py={setup_version}")
          PY

      - name: Run tests
        env:
          # Match CI defaults: tests should opt-in to data sources.
          BACKTESTING_DATA_SOURCE: none
          BACKTESTING_SHOW_PROGRESS_BAR: "false"
          AIOHTTP_NO_EXTENSIONS: 1
          # Optional: secrets allow provider-backed tests to run (same as CI).
          POLYGON_API_KEY: ${{ secrets.POLYGON_API_KEY }}
          THETADATA_USERNAME: ${{ secrets.THETADATA_USERNAME }}
          THETADATA_PASSWORD: ${{ secrets.THETADATA_PASSWORD }}
          DATADOWNLOADER_BASE_URL: ${{ secrets.DATADOWNLOADER_BASE_URL }}
          DATADOWNLOADER_API_KEY: ${{ secrets.DATADOWNLOADER_API_KEY }}
          ALPACA_TEST_API_KEY: ${{ secrets.ALPACA_TEST_API_KEY }}
          ALPACA_TEST_API_SECRET: ${{ secrets.ALPACA_TEST_API_SECRET }}
          TRADIER_TEST_ACCESS_TOKEN: ${{ secrets.TRADIER_TEST_ACCESS_TOKEN }}
          TRADIER_TEST_ACCOUNT_NUMBER: ${{ secrets.TRADIER_TEST_ACCOUNT_NUMBER }}
        run: |
          set -euo pipefail
          python -m pytest -m "not apitest and not downloader" --tb=short -q --durations=30

      - name: Build package
        run: |
          set -euo pipefail
          python -m build

      - name: Upload dist
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: |
            dist/*

  publish:
    name: Publish to PyPI + Create GitHub Release
    needs: validate-build
    runs-on: ubuntu-latest
    timeout-minutes: 20
    # Optional: configure this environment in GitHub settings to require approvals.
    environment: pypi
    steps:
      - name: Download dist
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist
          # Prefer API token publish. This avoids Trusted Publisher config drift.
          password: ${{ secrets.PYPI_API_TOKEN }}

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true

  start-next-version:
    name: Start next version branch
    needs: publish
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout dev
        uses: actions/checkout@v4
        with:
          ref: dev
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute next version and create branch
        run: |
          set -euo pipefail

          # Extract current version from the tag that triggered this workflow
          TAG="${GITHUB_REF_NAME}"          # e.g. v4.4.57
          VERSION="${TAG#v}"                # e.g. 4.4.57

          # Compute next patch version
          IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
          NEXT_PATCH=$((PATCH + 1))
          NEXT_VERSION="${MAJOR}.${MINOR}.${NEXT_PATCH}"
          BRANCH="version/${NEXT_VERSION}"

          echo "Current: ${VERSION} → Next: ${NEXT_VERSION} → Branch: ${BRANCH}"

          # Check if branch already exists (idempotent)
          if git ls-remote --heads origin "${BRANCH}" | grep -q "${BRANCH}"; then
            echo "Branch ${BRANCH} already exists — skipping."
            exit 0
          fi

          # Configure git
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          # Create the branch from dev
          git checkout -b "${BRANCH}"

          # Bump setup.py
          sed -i "s/version=\"${VERSION}\"/version=\"${NEXT_VERSION}\"/" setup.py
          grep "version=" setup.py  # verify

          # Add changelog placeholder
          sed -i "s/^# Changelog$/# Changelog\n\n## ${NEXT_VERSION} - Unreleased/" CHANGELOG.md

          # Commit and push
          git add setup.py CHANGELOG.md
          git commit -m "chore: start ${NEXT_VERSION}"
          git push -u origin "${BRANCH}"

          echo "✅ Created ${BRANCH} with setup.py=${NEXT_VERSION}"