release.yml

name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: "python -m pip install --only-binary :all: build==1.5.0 twine==6.2.0"
      - name: Verify tag matches package version
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          python - <<'PY'
          import os, tomllib
          with open("pyproject.toml", "rb") as handle:
              version = tomllib.load(handle)["project"]["version"]
          if os.environ["RELEASE_TAG"] != f"v{version}":
              raise SystemExit(f"tag {os.environ['RELEASE_TAG']} != v{version}")
          PY
      - run: python -m build
      - run: python -m twine check dist/*
      - name: Smoke-test the built wheel
        run: |
          # The X11 backend opens a display at import time, so the runner
          # needs a virtual one. Import from outside the checkout as well:
          # the repo root shadows site-packages on sys.path, so running this
          # here would test the source tree instead of the built wheel.
          sudo apt-get update && sudo apt-get install -y xvfb
          python -m venv /tmp/wheel-test
          /tmp/wheel-test/bin/pip install dist/*.whl
          cd /tmp && xvfb-run -a /tmp/wheel-test/bin/python -c "
          import je_auto_control, je_auto_control.api
          print('imported', je_auto_control.__file__)
          "
      - uses: actions/attest-build-provenance@v2
        with:
          subject-path: "dist/*"
      - uses: actions/upload-artifact@v4
        with:
          name: python-distributions
          path: dist/

  publish:
    needs: build
    # Publishing happens on merge to main (stable.yml), so this path stays
    # off: the tags stable.yml pushes would otherwise start a second upload
    # of a version PyPI already has. The build job above still runs on every
    # v* tag — it verifies the tag matches pyproject, smoke-tests the wheel
    # and attests provenance. To go back to tag-driven releases, register a
    # PyPI trusted publisher for release.yml, drop this condition, and put
    # stable.yml's publish job back behind `if: ${{ false }}`.
    if: ${{ false }}
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/je-auto-control
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: python-distributions
          path: dist/
      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0