SDK Updates: v4.0.0

.github/workflows/release.yml

@@ -0,0 +1,78 @@
+name: Release
+on:
+  push:
+    branches: ['main']
+    paths:
+      - '.github/workflows/release.yml'
+      - 'pyproject.toml'
+  workflow_dispatch:
+    inputs:
+      publish_to_package_manager:
+        description: 'Override PUBLISH_TO_PACKAGE_MANAGER for this run'
+        type: boolean
+        default: false
+
+env:
+  # Toggle to enable package-manager publishing on push to base.
+  # The workflow_dispatch input above overrides this on manual runs.
+  # Quoted so the value is always compared as a string (see the gate step below).
+  PUBLISH_TO_PACKAGE_MANAGER: 'false'
+  # Package identity is baked in at generation time so the workflow never has to
+  # read package metadata at runtime.
+  SDK_VERSION: '4.0.0'
+  SDK_PACKAGE_NAME: 'signplus-python'
+  RELEASE_TAG: 'v4.0.0'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create tag if it does not exist
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if gh api "repos/${{ github.repository }}/git/refs/tags/$RELEASE_TAG" >/dev/null 2>&1; then
+            echo "::notice::Tag $RELEASE_TAG already exists, nothing to do"
+            exit 0
+          fi
+          gh api -X POST "repos/${{ github.repository }}/git/refs" \
+            -f ref="refs/tags/$RELEASE_TAG" \
+            -f sha="${{ github.sha }}"
+          echo "::notice::Created tag $RELEASE_TAG at ${{ github.sha }}"
+      - name: Compute publish gate
+        id: gate
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "ok=${{ inputs.publish_to_package_manager }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "ok=$PUBLISH_TO_PACKAGE_MANAGER" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: actions/setup-python@v5
+        if: steps.gate.outputs.ok == 'true'
+        with:
+          python-version: '3.x'
+      - name: Build distribution
+        if: steps.gate.outputs.ok == 'true'
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+      - name: Publish to PyPI
+        if: steps.gate.outputs.ok == 'true'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          # Re-running on an already-published version is a no-op instead of a failure.
+          skip-existing: true
+      - name: Create GitHub release
+        if: steps.gate.outputs.ok == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            echo "::notice::Release $RELEASE_TAG already exists"
+          else
+            gh release create "$RELEASE_TAG" --title "$RELEASE_TAG" --generate-notes
+          fi