release.yml

name: release

on:
  push:
    tags: ["v*.*.*", "v*.*.*a*", "v*.*.*b*", "v*.*.*rc*"]

permissions:
  contents: read
  id-token: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Verify version matches tag
        run: |
          TAG="${GITHUB_REF#refs/tags/v}"
          PKG_VERSION=$(python -c "
import re, pathlib
text = pathlib.Path('src/tikhub/_version.py').read_text()
print(re.search(r'__version__\s*=\s*[\"'\''](.*?)[\"'\'']', text).group(1))
")
          if [ "$TAG" != "$PKG_VERSION" ]; then
            echo "::error::tag $TAG does not match package version $PKG_VERSION"
            exit 1
          fi
      - name: Install build tools
        run: python -m pip install --upgrade pip build
      - name: Run full test suite first
        run: |
          pip install -e ".[dev]"
          ruff check src tests scripts
          mypy src/tikhub
          pytest -q
          python scripts/verify_coverage.py
      - name: Build sdist + wheel
        run: python -m build
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/tikhub
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - name: Publish to PyPI (OIDC trusted publishing)
        uses: pypa/gh-action-pypi-publish@release/v1