release.yml

name: Publish release to PyPI

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
  workflow_dispatch:
    inputs:
      environment:
        type: environment
        description: "Environment in which to execute the release process"
env:
  UV_PYTHON_PREFERENCE: only-system
  # we do all UV syncing explicitly
  UV_NO_SYNC: "1"
jobs:
  extract-params:
    name: Determine release parameters
    runs-on: ubuntu-latest
    permissions: {}
    outputs:
      publish-env: ${{ steps.setenv.outputs.envname }}
      version: ${{ steps.getrelease.outputs.version }}
    steps:
      - id: setenv
        run: |
          if [[ $GITHUB_EVENT_NAME == 'workflow_dispatch' ]]; then
              echo "envname=${{ inputs.environment }}" >> "$GITHUB_OUTPUT"
          elif [[ $GITHUB_EVENT_NAME == 'push' ]]; then
              echo "envname=pypi" >> "$GITHUB_OUTPUT"
          else
              echo "Cannot run release workflow for trigger event $GITHUB_EVENT_NAME"
              exit 1
          fi
          cat "$GITHUB_OUTPUT"
      - name: Get version information
        id: getrelease
        run: |
          set -eo pipefail

          VER_REGEX="v[0-9]\+\.[0-9]\+\..\+"
          if [[ "${GITHUB_REF:0:11}" != 'refs/tags/v' ]]; then
              echo "Cannot run release workflow for ref $GITHUB_REF, must be a tag starting with 'v'"
              exit 1
          fi
          VERSION=${GITHUB_REF:10}

          if echo $VERSION | grep -q "$VER_REGEX"; then
            echo "version=${VERSION:1}" >> "$GITHUB_OUTPUT"
          else
            echo "Tag $VERSION does not follow v<version> naming scheme"
            exit 1
          fi
      - uses: actions/checkout@v6
      - name: Generate release body
        run: |
          sed "s/:VERSION/$VERSION/g" < .github/release-template.md > release.md
          cat release.md
        env:
          VERSION: ${{ steps.getrelease.outputs.version }}
      - name: Upload release body
        uses: actions/upload-artifact@v4
        with:
          name: release-body
          path: release.md
  build-wheels:
    runs-on: ${{ matrix.os }}
    needs: [extract-params]
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - ubuntu-24.04-arm
          - windows-latest
          - macos-14
    steps:
      - uses: actions/checkout@v6
      - name: Setup Python
        uses: actions/setup-python@v6
      - name: Build wheels
        uses: pypa/cibuildwheel@v3.3.0
      - uses: actions/upload-artifact@v4
        with:
          name: wheels-${{ matrix.os }}-${{ strategy.job-index }}
          path: ./wheelhouse/*.whl
  build-sdist:
    runs-on: ubuntu-latest
    needs: [extract-params]
    steps:
      - uses: actions/checkout@v6
      - name: Setup Python
        uses: actions/setup-python@v6
      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
      - name: Build source distribution
        run: uv build --sdist
      - uses: actions/upload-artifact@v4
        with:
          name: sdist
          path: ./dist/*.tar.gz
  publish:
    name: Publish release artifacts
    needs: [extract-params, build-sdist, build-wheels]
    runs-on: ubuntu-latest
    environment: ${{ needs.extract-params.outputs.publish-env }}
    permissions:
      # we use PyPI's trusted publisher model -> expose identity token
      id-token: write
      # Needed to create GitHub releases
      contents: write
    steps:
      - name: Download wheels
        uses: actions/download-artifact@v4
        with:
          pattern: wheels-*
          path: dist/
          merge-multiple: 'true'
      - name: Download source distribution
        uses: actions/download-artifact@v4
        with:
          name: sdist
          path: dist/
      - name: Download release body
        uses: actions/download-artifact@v4
        with:
          name: release-body
          path: release-body
      - name: Upload to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: ${{ vars.REPOSITORY_URL }}
      - name: Create GitHub release
        if: needs.extract-params.outputs.publish-env == 'pypi' && startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/*.whl
            dist/*.tar.gz
          body_path: release-body/release.md
          fail_on_unmatched_files: true
          name: v${{ needs.extract-params.outputs.version }}