python-publish.yml

name: Build and verify Python package

on:
  workflow_call:
    inputs:
      ref:
        description: Exact commit to test and package
        required: true
        type: string
      version:
        description: Expected package version without the v prefix
        required: true
        type: string

permissions:
  contents: read

jobs:
  test:
    uses: ./.github/workflows/run-pytest-on-push-and-all-prs.yml
    with:
      ref: ${{ inputs.ref }}

  build:
    name: Build and verify exact artifacts
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.ref }}
          persist-credentials: false

      - name: Verify exact release commit
        env:
          EXPECTED_SHA: ${{ inputs.ref }}
          EXPECTED_VERSION: ${{ inputs.version }}
        run: |
          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
          python - <<'PY'
          import os
          import pathlib
          import re

          expected = os.environ["EXPECTED_VERSION"]
          pyproject = pathlib.Path("pyproject.toml").read_text()
          match = re.search(r'^version = "([^"]+)"$', pyproject, re.MULTILINE)
          assert match and match.group(1) == expected
          PY

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"

      - name: Install package tooling
        run: |
          python -m pip install --upgrade pip
          pip install .[dev] twine

      - name: Stamp exact build commit
        env:
          RELEASE_SHA: ${{ inputs.ref }}
        run: printf 'COMMIT = "%s"\n' "$RELEASE_SHA" > rcpchgrowth/_build_info.py

      - name: Build source distribution and wheel once
        run: python -m build

      - name: Check and smoke-test exact artifacts
        env:
          EXPECTED_COMMIT: ${{ inputs.ref }}
          EXPECTED_VERSION: ${{ inputs.version }}
        run: |
          sdists=(dist/*.tar.gz)
          wheels=(dist/*.whl)
          test "${#sdists[@]}" -eq 1
          test "${#wheels[@]}" -eq 1
          [[ "${sdists[0]}" == "dist/rcpchgrowth-${EXPECTED_VERSION}.tar.gz" ]]
          [[ "${wheels[0]}" == "dist/rcpchgrowth-${EXPECTED_VERSION}-"*.whl ]]
          python -m twine check dist/*
          python tests/distribution/check-sdist.py "${sdists[0]}"
          python tests/distribution/check-wheel.py "${wheels[0]}"
          python -m venv /tmp/release-wheel-venv
          wheel_path="$PWD/${wheels[0]}"
          (
            cd /tmp
            env -u PYTHONPATH /tmp/release-wheel-venv/bin/python -m pip install "$wheel_path"
          )
          (
            cd /tmp
            env -u PYTHONPATH /tmp/release-wheel-venv/bin/python "$GITHUB_WORKSPACE/tests/distribution/installed-wheel-smoke.py"
          )
          sha256sum dist/* > artifact-sha256.txt

      - name: Retain verified artifacts
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: python-package-${{ inputs.ref }}
          path: |
            dist/*
            artifact-sha256.txt
          if-no-files-found: error
          retention-days: 7