publish-python.yml

name: publish-python

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      release_tag:
        description: "Optional Git tag to sync from, for example v1.2.3"
        required: false
        type: string

jobs:
  build:
    name: build-sdist-wheel
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Sync release metadata from tag
        env:
          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name }}
        run: |
          python scripts/release.py --tag "${RELEASE_TAG}" --workflow

      - name: Build package
        run: |
          python -m pip install --upgrade pip build twine
          rm -rf dist build *.egg-info
          python -m build
          python -m twine check dist/*

      - name: Verify built artifact versions
        env:
          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name }}
        run: |
          python - <<'PY'
          from pathlib import Path
          import os
          import tomllib

          tag = os.environ["RELEASE_TAG"].strip()
          if not tag.startswith("v"):
              raise SystemExit(f"Release tag must start with 'v': {tag}")

          version = tag[1:]
          pyproject_version = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))["project"]["version"]
          if pyproject_version != version:
              raise SystemExit(
                  f"pyproject.toml version {pyproject_version} does not match release tag version {version}"
              )

          dist = sorted(Path("dist").glob("*"))
          if not dist:
              raise SystemExit("No build artifacts found in dist/")

          names = [path.name for path in dist]
          expected = {
              f"vcf_rdfizer-{version}.tar.gz",
              f"vcf_rdfizer-{version}-py3-none-any.whl",
          }
          missing = sorted(expected.difference(names))
          if missing:
              raise SystemExit(
                  f"Built artifacts do not match project version {version}; missing: {', '.join(missing)}"
              )

          unexpected = sorted(
              name for name in names if name.startswith("vcf_rdfizer-") and f"vcf_rdfizer-{version}" not in name
          )
          if unexpected:
              raise SystemExit(
                  f"Found stale artifacts in dist/: {', '.join(unexpected)}"
              )

          print("Verified build artifacts:")
          for name in names:
              print(f"  {name}")
          PY

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: python-dist
          path: dist/*

  publish:
    name: publish-to-pypi
    runs-on: ubuntu-latest
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    environment:
      name: pypi
    permissions:
      id-token: write
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: python-dist
          path: dist

      - name: Publish package
        uses: pypa/gh-action-pypi-publish@release/v1