release.yml

---
name: Release

on: workflow_dispatch

jobs:
  release:
    name: Create release
    runs-on: ubuntu-latest

    permissions:
      # This is needed for https://github.com/stefanzweifel/git-auto-commit-action.
      contents: write

    outputs:
      version: ${{ steps.calver.outputs.release }}
      tag: ${{ steps.tag_version.outputs.new_tag }}

    steps:
      - uses: actions/checkout@v6
        with:
          # Fetch all history including tags.
          # Needed to find the latest tag.
          #
          # Also, avoids
          # https://github.com/stefanzweifel/git-auto-commit-action/issues/99.
          fetch-depth: 0
          # Credentials need to persist for stefanzweifel/git-auto-commit-action.
          # zizmor: ignore[artipacked]
          persist-credentials: true
          # Use a PAT so that the push from git-auto-commit-action
          # can bypass repository ruleset required status checks.
          # The default GITHUB_TOKEN cannot bypass rulesets.
          token: ${{ secrets.RELEASE_PAT }}

      - name: Calver calculate version
        uses: StephaneBour/actions-calver@master
        id: calver
        with:
          date_format: '%Y.%m.%d'
          release: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Get the changelog underline
        id: changelog_underline
        run: |
          underline="$(echo "${{ steps.calver.outputs.release }}" | tr -c '\n' '-')"
          echo "underline=${underline}" >> "$GITHUB_OUTPUT"

      - name: Update changelog
        id: update_changelog
        uses: jacobtomlinson/gha-find-replace@v3
        with:
          find: "Next\n----"
          replace: |
            Next
            ----

            ${{ steps.calver.outputs.release }}
            ${{ steps.changelog_underline.outputs.underline }}
          include: CHANGELOG.rst
          regex: false

      - name: Check Update changelog was modified
        run: |
          if [ "${{ steps.update_changelog.outputs.modifiedFiles }}" = "0" ]; then
            echo "Error: No files were modified when updating changelog"
            exit 1
          fi
      - uses: stefanzweifel/git-auto-commit-action@v7
        id: commit
        with:
          commit_message: Bump CHANGELOG
          file_pattern: CHANGELOG.rst
          # Error if there are no changes.
          skip_dirty_check: true

      - name: Bump version and push tag
        id: tag_version
        uses: mathieudutour/github-tag-action@v6.2
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          custom_tag: ${{ steps.calver.outputs.release }}
          tag_prefix: ''
          commit_sha: ${{ steps.commit.outputs.commit_hash }}

      - name: Create a GitHub release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ steps.tag_version.outputs.new_tag }}
          makeLatest: true
          name: Release ${{ steps.tag_version.outputs.new_tag }}
          body: ${{ steps.tag_version.outputs.changelog }}

  pypi:
    name: Publish to PyPI
    needs: release
    runs-on: ubuntu-latest

    # Specifying an environment is strongly recommended by PyPI.
    # See https://github.com/pypa/gh-action-pypi-publish/tree/release/v1/?tab=readme-ov-file#trusted-publishing.
    environment: release

    permissions:
      # This is needed for PyPI publishing.
      # See https://github.com/pypa/gh-action-pypi-publish/tree/release/v1/?tab=readme-ov-file#trusted-publishing.
      id-token: write

    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.release.outputs.tag }}
          # Fetch all history including tags.
          # Needed for setuptools-scm version detection.
          fetch-depth: 0
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: '**/pyproject.toml'

      - name: Build a binary wheel and a source tarball
        run: |
          uv build --sdist --wheel --out-dir dist/
          uv run --extra=release check-wheel-contents dist/*.whl

      # We use PyPI trusted publishing rather than a PyPI API token.
      # See https://github.com/pypa/gh-action-pypi-publish/tree/release/v1/?tab=readme-ov-file#trusted-publishing.
      - name: Publish distribution 📦 to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          verbose: true

  docker:
    name: Publish Docker images
    needs: release
    runs-on: ubuntu-latest

    permissions: {}

    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ needs.release.outputs.tag }}
          persist-credentials: false

      - name: Login to DockerHub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Build and push Docker images
        uses: docker/bake-action@v7.0.0
        with:
          push: true
        env:
          VERSION: ${{ needs.release.outputs.version }}