release.yml

name: Release

on:
  pull_request:
    types: [closed]
    branches:
      - main

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    if: |
      github.event.pull_request.merged == true &&
      (contains(github.event.pull_request.labels.*.name, 'bump:major') ||
       contains(github.event.pull_request.labels.*.name, 'bump:minor') ||
       contains(github.event.pull_request.labels.*.name, 'bump:patch'))
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write  # required for OIDC token request
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        id: setup-python
        with:
          python-version-file: "pyproject.toml"

      - name: Set up venv
        run: |
          uv venv --python ${{ steps.setup-python.outputs.python-path }}

      - name: Install dependencies
        run: |
          uv pip install -e .[build]

      - name: Get version
        id: current_version
        run: |
          echo "VERSION=$(cat VERSION)" >> $GITHUB_OUTPUT

      - name: Build package
        run: |
          uv build

      - name: Validate package
        run: |
          uv run twine check dist/*

      - name: Create and push tag
        run: |
          git tag "v${{ steps.current_version.outputs.VERSION }}"
          git push origin "v${{ steps.current_version.outputs.VERSION }}"

      - name: Publish to PyPI
        run: |
          uv publish

      - name: Create GitHub Release
        uses: softprops/action-gh-release@26994186c0ac3ef5cae75ac16aa32e8153525f77 # v1
        with:
          tag_name: "v${{ steps.current_version.outputs.VERSION }}"
          files: |
            dist/*.whl
            dist/*.tar.gz
          generate_release_notes: true
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}