release.yml

# Publishing was a step someone had to remember, and twice nobody did: v0.1.3
# and v0.1.4 were tagged and built and never uploaded, so `pip install
# waku-agent` served 0.1.1 while main moved 67 commits ahead. A rule did not
# fix that, because a rule is a reminder and a reminder is what failed.
#
# So the tag IS the release. Push v0.1.6 and this publishes it.
#
# No token is stored anywhere: PyPI Trusted Publishing lets GitHub prove which
# workflow in which repo is asking, over OIDC. That is what `id-token: write`
# below is for, and it is why there is no secret to leak or rotate.
name: release

on:
  push:
    tags: ["v*"]

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write  # OIDC — how PyPI knows this workflow is really us
      contents: write  # create the GitHub Release for the tag
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      # A tag is a human typing a number twice. If the two disagree, the tag
      # says one thing and the artifact says another, and PyPI believes the
      # artifact — so stop here rather than publish a version nobody tagged.
      - name: The tag must be the version in prometheus/__init__.py
        run: |
          tag="${GITHUB_REF_NAME#v}"
          pkg=$(python -c "import re,pathlib; print(re.search(r'__version__ = \"(.*?)\"', pathlib.Path('prometheus/__init__.py').read_text()).group(1))")
          echo "tag=$tag  package=$pkg"
          if [ "$tag" != "$pkg" ]; then
            echo "::error::tag $GITHUB_REF_NAME does not match __version__ $pkg — nothing published."
            exit 1
          fi

      # The gate that guards main guards a release too. Publishing is the one
      # action here that cannot be undone: PyPI does not allow re-uploading a
      # version, even after a delete.
      - name: Install
        run: pip install -e '.[dev,hosted]'
      - name: Deterministic evals
        run: python -m pytest -q evals/deterministic

      - name: Build
        run: pipx run build
      - name: Check the artifacts
        run: pipx run twine check dist/*

      - uses: pypa/gh-action-pypi-publish@release/v1

      # The GitHub Release comes after PyPI, never before: the Releases page
      # should only name a version `pip install` can already fetch. It carries
      # the same wheel and sdist, and notes GitHub writes from the PRs merged
      # since the previous release. Until 2026-09-13 only v0.1.0 and v0.1.1
      # had one, so the repo page called v0.1.1 "Latest" for six weeks while
      # PyPI moved on.
      - name: GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: >
          gh release create "$GITHUB_REF_NAME" dist/*.whl dist/*.tar.gz
          --repo "$GITHUB_REPOSITORY" --verify-tag --generate-notes --title "$GITHUB_REF_NAME"