release-python.yml

name: Release Python

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (without v prefix)'
        required: true

jobs:
  build-wheels:
    name: Build wheels on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]

    steps:
      - name: Checkout repository
        shell: bash
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "+${GITHUB_REF}:refs/github/checkout"
          git checkout --detach refs/github/checkout

      - name: Set up Rust
        shell: bash
        run: |
          rustup toolchain install stable --profile minimal --no-self-update
          rustup default stable

      - name: Install maturin
        run: python -m pip install --upgrade pip 'maturin>=1.0,<1.11'

      - name: Build wheels
        run: python -m maturin build --manifest-path python/Cargo.toml --release --out python/dist

      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-${{ matrix.os }}
          path: python/dist/*.whl

  # Build source distribution
  build-sdist:
    name: Build source distribution
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        shell: bash
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "+${GITHUB_REF}:refs/github/checkout"
          git checkout --detach refs/github/checkout

      - name: Install maturin
        run: python -m pip install --upgrade pip 'maturin>=1.0,<1.11'

      - name: Build sdist
        run: python -m maturin sdist --manifest-path python/Cargo.toml --out python/dist

      - name: Upload sdist
        uses: actions/upload-artifact@v7
        with:
          name: sdist
          path: python/dist/*.tar.gz

  publish:
    name: Publish to PyPI
    needs: [build-wheels, build-sdist]
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write  # For trusted publishing

    steps:
      - name: Checkout repository
        shell: bash
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "+${GITHUB_REF}:refs/github/checkout"
          git checkout --detach refs/github/checkout

      - name: Check release metadata consistency
        run: python3 scripts/check_release_versions.py

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: dist
          merge-multiple: true

      - name: Preflight release artifacts
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob

          wheels=(dist/*.whl)
          sdists=(dist/*.tar.gz)

          if [[ ${#wheels[@]} -eq 0 ]]; then
            echo "No wheel artifacts found in dist/."
            exit 1
          fi

          if [[ ${#sdists[@]} -eq 0 ]]; then
            echo "No source distribution artifact found in dist/."
            exit 1
          fi

          echo "Artifact preflight passed."

      - name: Preflight PyPI trusted publishing
        shell: bash
        run: |
          set -euo pipefail

          if [[ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" || -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]]; then
            echo "Missing GitHub OIDC request environment. Ensure this job has 'permissions: id-token: write'."
            exit 1
          fi

          response="$(curl --fail --silent --show-error \
            -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=pypi")"

          token="$(python -c 'import json,sys; print(json.load(sys.stdin).get("value",""))' <<<"$response")"

          if [[ -z "$token" ]]; then
            echo "Failed to mint OIDC token for audience 'pypi'. Check PyPI trusted publisher settings."
            exit 1
          fi

          echo "PyPI trusted publishing preflight passed."

      - name: Install uv
        run: python -m pip install --upgrade uv

      - name: Remove already-published PyPI files
        id: pypi_existing
        shell: bash
        run: |
          set -euo pipefail

          python3 - <<'PY'
          from html.parser import HTMLParser
          from pathlib import Path
          from urllib.parse import unquote, urlparse
          from urllib.request import urlopen

          class LinkParser(HTMLParser):
              def __init__(self):
                  super().__init__()
                  self.hrefs = []

              def handle_starttag(self, tag, attrs):
                  if tag != "a":
                      return
                  attrs_dict = dict(attrs)
                  href = attrs_dict.get("href")
                  if href:
                      self.hrefs.append(href)

          parser = LinkParser()
          with urlopen("https://pypi.org/simple/subtr-actor-py/", timeout=30) as response:
              parser.feed(response.read().decode("utf-8", errors="replace"))

          published = {
              Path(unquote(urlparse(href).path)).name
              for href in parser.hrefs
          }

          remaining = []
          for artifact in Path("dist").iterdir():
              if not artifact.is_file():
                  continue
              if artifact.name in published:
                  print(f"Skipping already-published PyPI artifact: {artifact.name}")
                  artifact.unlink()
              else:
                  remaining.append(artifact)

          if remaining:
              print("Remaining PyPI artifacts:")
              for artifact in remaining:
                  print(f"- {artifact.name}")
          else:
              print("All PyPI artifacts are already published.")
          PY

          if compgen -G "dist/*" > /dev/null; then
            echo "has_files=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_files=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish to PyPI
        if: steps.pypi_existing.outputs.has_files == 'true'
        run: uv publish --trusted-publishing automatic dist/*