publish.yml

# Runs only while the repository is public: nothing is bumped, tagged or
# published while it is private. The one other change from the copied
# workflow: the built files are checked for names that must not ship before
# anything is pushed or published, and so are the commit messages since the
# last tag. The internal-name list is the DN_NAME_CHECK_WORDS organisation
# secret; without it the check fails and nothing is released.
#
# Auto-release bynn-decisionnode on every push to main: bump the patch in
# pyproject.toml, _version.py and uv.lock, run the tests, build, publish to
# PyPI, push the bump commit and tag back to main, and cut the GitHub release.
# The push back uses the default GITHUB_TOKEN, which does not retrigger this
# workflow, and the bump commit carries [skip publish] as a second guard.
#
# To ship without cutting a release (docs, CI tweaks), put [skip publish] in
# the commit message.
#
# Publishes via PyPI OIDC trusted publishing bound to the pypi-publish
# environment: no PYPI_API_TOKEN, no stored credential. The publish action
# mints PEP 740 digital attestations (Sigstore) by default on the trusted-
# publishing path and uploads them beside the release. Requires this repo +
# workflow + environment registered as a trusted publisher on pypi.org.
name: Publish to PyPI

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: publish
  cancel-in-progress: false

permissions: read-all

jobs:
  publish:
    if: "github.event.repository.visibility == 'public' && !contains(github.event.head_commit.message, '[skip publish]')"
    runs-on: ubuntu-latest
    environment: pypi-publish
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: '3.12'

      - id: bump
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          CURRENT=$(grep -m1 '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
          NEW="${CURRENT%.*}.$(( ${CURRENT##*.} + 1 ))"
          sed -i "s/^version = \"${CURRENT}\"/version = \"${NEW}\"/" pyproject.toml
          sed -i "s/__version__ = \"${CURRENT}\"/__version__ = \"${NEW}\"/" src/decisionnode/_version.py
          sed -i "/^name = \"bynn-decisionnode\"$/{n;s/^version = \"${CURRENT}\"$/version = \"${NEW}\"/}" uv.lock
          echo "version=${NEW}" >> "$GITHUB_OUTPUT"

      - run: |
          python -m pip install --upgrade pip
          pip install -e . --group dev build
      - run: pytest tests --ignore=tests/conformance

      - run: python -m build
      - run: python .github/scripts/check_names.py --commits dist/
        env:
          DN_NAME_CHECK_WORDS: ${{ secrets.DN_NAME_CHECK_WORDS }}

      - run: |
          git add pyproject.toml src/decisionnode/_version.py uv.lock
          git commit -m "Release v${{ steps.bump.outputs.version }} [skip publish]"
          git tag "v${{ steps.bump.outputs.version }}"
          git push origin HEAD:main "v${{ steps.bump.outputs.version }}"

      # No password: OIDC trusted publishing. With id-token: write present and
      # this repo registered as a trusted publisher, the action authenticates
      # by OIDC and generates PEP 740 attestations (attestations: true is the
      # default): a Sigstore signature over each artifact, shown on pypi.org.
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1

      - run: gh release create "v${{ steps.bump.outputs.version }}" --title "v${{ steps.bump.outputs.version }}" --generate-notes
        env:
          GH_TOKEN: ${{ github.token }}