release.yml

name: Release

on:
  push:
    tags: ["v*"]

jobs:
  ci:
    uses: ./.github/workflows/ci.yml

  validate-tag:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Verify tag is on main
        run: |
          git fetch origin main
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            echo "::error::Tag is not an ancestor of main — refusing to release"
            exit 1
          fi
      - name: Verify tag matches pyproject.toml version
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          TOML_VERSION=$(grep '^version' pyproject.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          if [ "$TAG_VERSION" != "$TOML_VERSION" ]; then
            echo "::error::Tag $GITHUB_REF_NAME doesn't match pyproject.toml version $TOML_VERSION"
            exit 1
          fi

  build:
    needs: [ci, validate-tag]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
      - run: uv build
      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/

  publish:
    needs: build
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1

  verify:
    needs: publish
    runs-on: ubuntu-latest
    steps:
      - uses: astral-sh/setup-uv@v7
        with:
          python-version: "3.12"
      - name: Wait for PyPI propagation and verify
        run: |
          MAX_ATTEMPTS=10
          SLEEP_SECS=30
          for attempt in $(seq 1 $MAX_ATTEMPTS); do
            if VERSION_OUTPUT=$(uvx --from "warpline==${GITHUB_REF_NAME#v}" warpline --version 2>&1); then
              echo "Installed on attempt $attempt"
              echo "$VERSION_OUTPUT"
              exit 0
            fi
            echo "$VERSION_OUTPUT"
            echo "Attempt $attempt/$MAX_ATTEMPTS: package not yet available, waiting ${SLEEP_SECS}s..."
            sleep $SLEEP_SECS
          done
          echo "::error::Package warpline==${GITHUB_REF_NAME#v} not available on PyPI after $((MAX_ATTEMPTS * SLEEP_SECS))s"
          exit 1

  github-release:
    needs: [publish, verify]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/
      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "${{ github.ref_name }}" dist/* --generate-notes ||
          gh release upload "${{ github.ref_name }}" dist/* --clobber