release.yml

name: release

# Publish to PyPI when a GitHub Release is published.
#
# Uses PyPI Trusted Publishing (OIDC): no long-lived tokens anywhere.
# The publish action generates and uploads PEP 740 attestations by
# default, so every artifact is cryptographically tied to this repo,
# this workflow, and the release commit.
#
# All actions are pinned to full commit SHAs (comment shows the tag).

on:
  release:
    types: [published]

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Check tag matches package version
        # A v1.2.3 release must ship a package that says 1.2.3.
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          VERSION=$(python -c "import runpy; print(runpy.run_path('lm15/_version.py')['__version__'])")
          if [ "$TAG" != "$VERSION" ]; then
            echo "::error::tag $GITHUB_REF_NAME does not match source version $VERSION"
            exit 1
          fi
      - name: Build sdist and wheel
        run: |
          # Pinned with hashes (requirements/release.txt); regenerate with
          #   uv pip compile --generate-hashes -o requirements/release.txt requirements/release.in
          python -m pip install --quiet --require-hashes -r requirements/release.txt
          python -m build
          python -m twine check --strict dist/*
      - name: Verify installed wheel version
        run: |
          python -m pip install --no-deps dist/*.whl
          python -m pip check
          python -I -c "import importlib.metadata, os, lm15; expected = os.environ['GITHUB_REF_NAME'].removeprefix('v'); assert lm15.__version__ == importlib.metadata.version('lm15') == expected"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  publish:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/lm15/
    permissions:
      id-token: write # required for PyPI Trusted Publishing (OIDC)
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          # PyPI's reason for a refusal is only printed in verbose mode (2026-09-25:
          # a bare "400 Bad Request").
          verbose: true