release.yml

name: Publish to PyPI

on:
  release:
    types:
      - published

permissions:
  contents: read

concurrency:
  group: pypi-${{ github.event.release.tag_name }}
  cancel-in-progress: false

jobs:
  build:
    name: Build and verify distributions
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    env:
      PIP_DISABLE_PIP_VERSION_CHECK: "1"
      PYTHONUTF8: "1"

    steps:
      - name: Check out the released commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"

      - name: Verify the release identity
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        shell: bash
        run: |
          python - <<'PY'
          import ast
          import os
          import tomllib
          from pathlib import Path

          project = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))["project"]
          if project["name"] != "annotateit-ai":
              raise SystemExit(f"Unexpected project name: {project['name']!r}")

          version = project["version"]
          expected_tag = f"v{version}"
          release_tag = os.environ["RELEASE_TAG"]
          if os.environ["GITHUB_REF_TYPE"] != "tag":
              raise SystemExit("Release workflow is not running from a tag ref.")
          if os.environ["GITHUB_REF_NAME"] != release_tag:
              raise SystemExit("Release tag and GitHub ref do not match.")
          if release_tag != expected_tag:
              raise SystemExit(
                  f"Release tag {release_tag!r} does not match project version {version!r}; "
                  f"expected {expected_tag!r}."
              )

          tree = ast.parse(Path("src/annotateit_ai/_version.py").read_text(encoding="utf-8"))
          runtime_version = None
          for node in tree.body:
              if isinstance(node, ast.Assign) and any(
                  isinstance(target, ast.Name) and target.id == "__version__" for target in node.targets
              ):
                  runtime_version = ast.literal_eval(node.value)
                  break
          if runtime_version != version:
              raise SystemExit(
                  f"Runtime version {runtime_version!r} does not match project version {version!r}."
              )

          print(f"Verified annotateit-ai {version} from {release_tag}.")
          PY

          if ! git merge-base --is-ancestor "$GITHUB_SHA" "refs/remotes/origin/${DEFAULT_BRANCH}"; then
            echo "Release commit is not contained in ${DEFAULT_BRANCH}." >&2
            exit 1
          fi

      - name: Install package and development tools
        run: python -m pip install -e ".[dev]"

      - name: Run release quality gates
        run: |
          python -m ruff format --check src tests scripts
          python -m ruff check src tests scripts
          python -m mypy
          python -m pytest --cov=annotateit_ai --cov-report=term-missing

      - name: Build wheel and source distribution
        run: python -m build

      - name: Verify distributions and metadata
        run: |
          python -m twine check --strict dist/*
          python scripts/verify-distributions.py dist

      - name: Smoke-test the built wheel
        shell: bash
        run: |
          python -m venv "${RUNNER_TEMP}/release-smoke"
          "${RUNNER_TEMP}/release-smoke/bin/python" -m pip install --no-cache-dir dist/*.whl
          "${RUNNER_TEMP}/release-smoke/bin/annotateit" --help

      - name: Store verified distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-dists-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            dist/*.whl
            dist/*.tar.gz
          if-no-files-found: error
          retention-days: 7
          compression-level: 0

  publish:
    name: Publish distributions to PyPI
    if: github.event.release.prerelease == false
    needs:
      - build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment:
      name: pypi
      url: https://pypi.org/project/annotateit-ai/
    permissions:
      id-token: write

    steps:
      - name: Retrieve verified distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-dists-${{ github.run_id }}-${{ github.run_attempt }}
          path: dist/

      - name: Publish distributions to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: dist/
          attestations: true