release.yml

name: Release & Publish

on:
  push:
    branches:
      - main

concurrency:
  group: release
  cancel-in-progress: false

jobs:

  Release:
    runs-on: ubuntu-latest
    outputs:
      released: ${{ steps.release.outputs.released }}
    permissions:
      contents: read
      id-token: write
    steps:
    - name: Authenticate to GitHub
      id: octo-sts
      uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
      with:
        scope: hadrien/FastSQLA
        identity: release
    - name: 📥 checkout
      uses: actions/checkout@v7
      with:
        fetch-depth: 0
        token: ${{ steps.octo-sts.outputs.token }}
    - name: 🔧 setup uv
      uses: ./.github/uv
    - name: 📜 semantic release version & build
      id: release
      run: |
        next_version=$(uv run semantic-release version --print)
        last_released_version=$(uv run semantic-release version --print-last-released)
        if [[ "$next_version" == "$last_released_version" ]]; then
          echo "🙅🏽 Nothing to publish"
        else
          expected_head=$(git rev-parse HEAD)
          uv run semantic-release --strict version \
            --no-commit --no-tag --no-push --no-vcs-release

          # GitHub signs this API commit; expectedHeadOid rejects concurrent main updates.
          jq -n \
            --arg repository "$GITHUB_REPOSITORY" \
            --arg head "$expected_head" \
            --arg version "$next_version" \
            --rawfile project pyproject.toml \
            --rawfile lock uv.lock \
            --rawfile changelog CHANGELOG.md '
            {
              query: "mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid signature { isValid } } } }",
              variables: {input: {
                branch: {repositoryNameWithOwner: $repository, branchName: "main"},
                expectedHeadOid: $head,
                message: {headline: ("chore(release): v" + $version)},
                fileChanges: {additions: [
                  {path: "pyproject.toml", contents: ($project | @base64)},
                  {path: "uv.lock", contents: ($lock | @base64)},
                  {path: "CHANGELOG.md", contents: ($changelog | @base64)}
                ]}
              }}
            }' > "$RUNNER_TEMP/release-commit.json"
          gh api graphql --input "$RUNNER_TEMP/release-commit.json" \
            > "$RUNNER_TEMP/release-commit-response.json"
          release_commit=$(jq -er '
            .data.createCommitOnBranch.commit |
            select(.signature.isValid == true) | .oid |
            select(test("^[0-9a-f]{40}$"))
          ' "$RUNNER_TEMP/release-commit-response.json")
          git fetch origin "$release_commit"
          git reset --hard "$release_commit"
          uv run semantic-release --strict version \
            --skip-build --no-changelog --no-commit --tag --push --vcs-release
          echo "released=true" >> "$GITHUB_OUTPUT"
        fi
      env:
        GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
    - name: Upload distributions
      if: steps.release.outputs.released == 'true'
      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
      with:
        name: distributions
        path: dist/
        if-no-files-found: error

  Publish:
    needs: Release
    if: needs.Release.outputs.released == 'true'
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/fastsqla/
    permissions:
      id-token: write
    steps:
    - name: Download distributions
      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
      with:
        name: distributions
        path: dist/
    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
      with:
        skip-existing: true