release.yml

name: Release

# Conforms to the umbrella SDK release pipeline contract:
# u5c-factory reference/sdk-pipeline.md
on:
  push:
    tags: ['v*']

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Verify tag matches package version
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          MANIFEST=$(sed -nE 's/^version = "(.+)"/\1/p' pyproject.toml | head -1)
          if [ "$TAG" != "$MANIFEST" ]; then
            echo "::error::tag $GITHUB_REF_NAME does not match pyproject.toml version $MANIFEST"
            exit 1
          fi

  build:
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pipx install poetry
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"
          cache: poetry
      # Relock first: poetry.lock is stale vs pyproject.toml (see ci.yml).
      - run: poetry lock
      - run: poetry install
      - run: poetry build

  test:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pipx install poetry
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"
          cache: poetry
      - run: poetry lock
      - run: poetry install
      # No pytest suite yet; import-smoke the package (see ci.yml).
      - run: poetry run python -c "import utxorpc"

  publish:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pipx install poetry
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"
          cache: poetry
      - name: Publish to PyPI
        env:
          PYPI_REGISTRY_TOKEN: ${{ secrets.PYPI_REGISTRY_TOKEN }}
        run: poetry publish --build --username __token__ --password "$PYPI_REGISTRY_TOKEN"

  # Publishing the package and announcing it are separate concerns: this job is
  # kept apart from `publish` so the credential-bearing job keeps `contents: read`.
  release:
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          # A SemVer pre-release suffix is the only place a hyphen appears in the tag.
          prerelease: ${{ contains(github.ref_name, '-') }}