release.yml

name: Release

# Publishes to PyPI with trusted publishing (OIDC, no long-lived token) and
# creates the GitHub release. The very first PyPI upload is done by hand from
# the owner's machine, because the trusted publisher is configured on PyPI
# after the project exists (see docs/TODO.md).
#
# The UnityInFlow org allows only actions/checkout@* in public repos (SHA
# pinned), so this uses `uv publish --trusted-publishing always` (uv's native
# OIDC exchange) instead of pypa/gh-action-pypi-publish, and no artifact
# actions.

on:
  push:
    tags: ["v*"]

env:
  UV_VERSION: "0.11.32"

jobs:
  release:
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install uv
        run: |
          curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Check tag matches package version
        run: |
          tag="${GITHUB_REF_NAME#v}"
          pkg="$(uv run --no-project python -c 'import tomllib;print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')"
          test "$tag" = "$pkg" || { echo "tag $tag != pyproject $pkg"; exit 1; }

      - name: Build
        run: uv build

      - name: Publish to PyPI (trusted publishing)
        run: uv publish --trusted-publishing always

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "$GITHUB_REF_NAME" dist/* --generate-notes