release.yml

name: release

# Publish the Python package (python/) to PyPI when a GitHub Release
# tagged python-v<version> is published. Each language releases on its own
# tag prefix (python-v, ts-v, r-v, julia-v); a bare v<version> tag is
# refused here rather than guessed. PyPI Trusted Publishing (OIDC): no
# stored tokens, bound to this file's name and the `pypi` environment, so
# keep both. The publish action uploads PEP 740 attestations. Actions
# pinned to commit SHAs.

on:
  release:
    types: [published]

permissions: {}

jobs:
  build:
    # a Python tag, or a bare v-tag (refused with the reason below); other languages' tags skip
    if: startsWith(github.event.release.tag_name, 'python-v') || startsWith(github.event.release.tag_name, 'v')
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: python
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Check tag matches the package version
        run: |
          case "$GITHUB_REF_NAME" in
            python-v*) ;;
            *) echo "::error::tag $GITHUB_REF_NAME: Python releases are tagged python-v<version> (e.g. python-v1.1.0)"; exit 1 ;;
          esac
          TAG="${GITHUB_REF_NAME#python-v}"
          VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
          if [ "$TAG" != "$VERSION" ]; then
            echo "::error::tag $GITHUB_REF_NAME does not match version $VERSION"; exit 1
          fi
      - name: Build sdist and wheel
        run: |
          python -m pip install --quiet build==1.3.0 twine==7.0.0
          python -m build --outdir ../dist
          python -m twine check --strict ../dist/*
      - name: Smoke-test the wheel
        run: |
          python -m pip install "$(ls ../dist/*.whl)[data]"
          cd /tmp && python -I -c "import functai, dpyr, importlib.metadata as m, os; assert functai.__version__ == m.version('functai') == os.environ['GITHUB_REF_NAME'].removeprefix('python-v'); print(functai.evaluate)"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  publish:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/functai/
    permissions:
      id-token: write # PyPI Trusted Publishing (OIDC)
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 (twine 7: reads Metadata-Version 2.5, which hatchling now writes)