release.yml

name: Release

# Publishes webshare-sdk to PyPI when a version tag is pushed.
# Tag format: v1.2.3 (must match the version in pyproject.toml).
#
# Auth uses PyPI Trusted Publishing (OIDC) — there is NO API token to store.
# One-time setup on PyPI: Project → Publishing → add a trusted publisher for
#   owner: webshare-proxy  repo: webshare-python  workflow: release.yml
#   environment: release
on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  UV_VERSION: "0.6.14"

jobs:
  build:
    name: Build distributions
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Install uv
        run: pip install "uv==${UV_VERSION}"

      - name: Verify tag matches pyproject.toml version
        run: |
          proj_version="$(uv run python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
          tag_version="${GITHUB_REF_NAME#v}"
          if [ "$proj_version" != "$tag_version" ]; then
            echo "Tag $GITHUB_REF_NAME (=$tag_version) does not match pyproject version $proj_version" >&2
            exit 1
          fi

      - name: Build sdist and wheel
        run: uv build
      - name: Check metadata
        run: uvx twine@6.1.0 check dist/*
      - name: Assert py.typed is shipped in the wheel
        run: unzip -l dist/*.whl | grep "webshare/py.typed"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: dist/

  publish:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write # required for Trusted Publishing (OIDC)
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist/
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2