publish-python.yml

name: publish-python

# Publish the native PyO3 Python SDK on a `python-vX.Y.Z` tag (independent of the daemon's `v*` tags).
# Builds an abi3 wheel per platform with maturin, then ships them BOTH ways:
#   - PyPI (`pip install a3s-sentry`) — needs a `PYPI_API_TOKEN` secret; skipped gracefully if unset.
#   - GitHub Release — always, via the built-in GITHUB_TOKEN (a token-free fallback, like a3s-code).
on:
  push:
    tags: ["python-v*"]

permissions:
  contents: read

jobs:
  wheels:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
        with: { submodules: true }
      - uses: PyO3/maturin-action@v1
        with:
          command: build
          args: --release --out dist --manifest-path sdk/python/Cargo.toml
      - uses: actions/upload-artifact@v4
        with:
          name: wheels-${{ matrix.os }}
          path: dist

  publish:
    needs: wheels
    runs-on: ubuntu-latest
    permissions:
      contents: write # create / upload the GitHub Release
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true
      - name: PyPI (skipped if PYPI_API_TOKEN is unset)
        env:
          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        run: |
          if [ -n "$MATURIN_PYPI_TOKEN" ]; then
            pip install maturin
            maturin upload --skip-existing dist/*
          else
            echo "PYPI_API_TOKEN not set — skipping PyPI; wheels still ship to the GitHub Release."
          fi
      - name: GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          name: Python SDK ${{ github.ref_name }}
          generate_release_notes: true