release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      dry-run:
        description: "Build wheels without publishing (set to 'true' to skip upload)"
        required: false
        default: "false"

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  # ------------------------------------------------------------------
  # Linux — manylinux + musllinux, x86_64 + aarch64.
  # ------------------------------------------------------------------
  linux:
    name: wheels linux / ${{ matrix.target }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target: [x86_64, aarch64]
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Build manylinux wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist
          manylinux: auto

      - name: Build musllinux wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist
          manylinux: musllinux_1_2

      - uses: actions/upload-artifact@v7
        with:
          name: wheels-linux-${{ matrix.target }}
          path: dist

  # ------------------------------------------------------------------
  # macOS — x86_64 + aarch64 (Apple Silicon). One wheel each; macOS
  # universal2 is available via `--target universal2-apple-darwin` but
  # splitting keeps download sizes smaller and is standard on PyPI.
  # ------------------------------------------------------------------
  macos:
    name: wheels macOS / ${{ matrix.target }}
    runs-on: macos-latest
    strategy:
      fail-fast: false
      matrix:
        target: [x86_64, aarch64]
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist

      - uses: actions/upload-artifact@v7
        with:
          name: wheels-macos-${{ matrix.target }}
          path: dist

  # ------------------------------------------------------------------
  # Windows — x64 + ARM64.
  # ------------------------------------------------------------------
  windows:
    name: wheels Windows / ${{ matrix.target }}
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        target: [x64, aarch64]
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          architecture: x64

      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist

      - uses: actions/upload-artifact@v7
        with:
          name: wheels-windows-${{ matrix.target }}
          path: dist

  # ------------------------------------------------------------------
  # Source distribution — pure tarball. Consumers without a matching
  # prebuilt wheel fall back to this and compile locally.
  # ------------------------------------------------------------------
  sdist:
    name: sdist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist

      - uses: actions/upload-artifact@v7
        with:
          name: wheels-sdist
          path: dist

  # ------------------------------------------------------------------
  # Publish — PyPI Trusted Publishers (OIDC, no API tokens).
  # Set up: https://docs.pypi.org/trusted-publishers/
  # ------------------------------------------------------------------
  release:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    needs: [linux, macos, windows, sdist]
    if: startsWith(github.ref, 'refs/tags/v') && inputs.dry-run != 'true'
    environment:
      name: pypi
      url: https://pypi.org/p/ktav
    permissions:
      id-token: write  # PyPI Trusted Publishers (OIDC)
    steps:
      - uses: actions/download-artifact@v8
        with:
          path: dist
          merge-multiple: true

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist
          skip-existing: true

  # ------------------------------------------------------------------
  # GitHub Release — pulls notes from the matching `## [vX.Y.Z]`
  # section of CHANGELOG.md and attaches the built wheels + sdist as
  # downloadable assets. Runs after PyPI publish so a failed PyPI
  # upload doesn't leave a misleading GH Release behind.
  # ------------------------------------------------------------------
  github-release:
    name: GitHub Release
    runs-on: ubuntu-latest
    needs: [release]
    if: startsWith(github.ref, 'refs/tags/v') && inputs.dry-run != 'true'
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6

      - uses: actions/download-artifact@v8
        with:
          path: dist
          merge-multiple: true

      - name: Extract release notes from CHANGELOG.md
        id: notes
        shell: bash
        run: |
          ver="${GITHUB_REF#refs/tags/v}"
          notes=$(awk -v v="$ver" '
            $0 ~ "^## \\[" v "\\]" { in_section = 1; next }
            in_section && /^## \[/ { exit }
            in_section { print }
          ' CHANGELOG.md)
          {
            echo "body<<__END_NOTES__"
            echo "$notes"
            echo "__END_NOTES__"
          } >> "$GITHUB_OUTPUT"

      - uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          body: ${{ steps.notes.outputs.body }}
          files: dist/*
          fail_on_unmatched_files: false