release-python.yml

name: Release Python to PyPI

on:
  push:
    tags: ['v*']

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Verify tag matches pyproject version
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PYPROJ_VERSION=$(python -c "import tomllib; print(tomllib.load(open('src/python/pyproject.toml','rb'))['project']['version'])")
          # Normalize SemVer pre-release (0.2.0-rc.1) ↔ PEP 440 (0.2.0rc1) for comparison.
          # sed avoids tr's "-." being misparsed as an option flag.
          A=$(echo "$TAG_VERSION" | sed 's/[-.]//g')
          B=$(echo "$PYPROJ_VERSION" | sed 's/[-.]//g')
          if [ "$A" != "$B" ]; then
            echo "Tag $TAG_VERSION does not match pyproject version $PYPROJ_VERSION"
            exit 1
          fi
          echo "Version OK: $TAG_VERSION ↔ $PYPROJ_VERSION"

      - name: Install build tools
        run: pip install build twine

      - name: Build
        working-directory: src/python
        run: python -m build

      - name: Twine check
        working-directory: src/python
        run: twine check dist/*

      - name: Publish to PyPI
        working-directory: src/python
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
        run: twine upload dist/*