release.yml

name: Release

# Publishes `shield360` to PyPI.
#
# This file is generated. It lives in ThinkfleetAI/Shield360 as
# .github/mirror-workflows/python.yml and is written here by the mirror sync,
# so edit it there.
#
# The release runs here rather than in Shield360 so that the package page's
# Repository and Homepage links reach a repository customers can open, and so
# the README PyPI renders is the one written for this repository.

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  publish:
    name: Publish / PyPI
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: '3.12'

      # The tag is what a person types. Refuse to publish a version the tag
      # does not actually name, rather than shipping a surprise to PyPI.
      - name: Verify the tag matches the package version
        if: github.ref_type == 'tag'
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          PYPROJECT_VERSION=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['tool']['poetry']['version'])")
          test "$PYPROJECT_VERSION" = "$VERSION"

      - name: Install build tools
        run: |
          python -m pip install --upgrade pip
          pip install poetry twine

      - name: Build and validate
        run: |
          poetry check
          poetry build
          twine check dist/*

      - name: Publish
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          user: __token__
          password: ${{ secrets.PYPI_API_TOKEN }}
          verbose: true