release-python.yml

name: Release Python SDK

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:  # Manual trigger is always dry-run (rehearsal mode)

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  smithy:
    uses: $/.github/workflows/smithy-verify.yml
    permissions:
      contents: read

  test:
    name: Test Python SDK
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: python
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
        # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation

      - name: Set up Python
        run: uv python install 3.13

      - name: Install dependencies
        run: uv sync --dev --python 3.13

      - name: Lint
        run: |
          uv run ruff check src/ tests/
          uv run ruff format --check src/ tests/

      - name: Type check
        run: uv run mypy src/basecamp/ --ignore-missing-imports

      # Same script `make py-check-drift` and the test workflow run. It cannot be
      # the in-place `git status` check it replaces: that reports what
      # regenerating CHANGED, and a stale module already committed is changed by
      # nothing — the sweep removes a module the previous barrel named, which a
      # module absent from that barrel never was. Regenerating in place is sound
      # only where the generator wipes its output directory first, which is why
      # release-kotlin.yml can keep doing it and this cannot. Publishing is the
      # last place to find that out.
      - name: Check generated code drift
        run: ../scripts/check-python-service-drift.sh

      - name: Run tests with coverage
        run: uv run pytest --cov --cov-report=term-missing --cov-fail-under=60

  # Building is deliberately separate from publishing: this job carries no
  # `environment:`, so a workflow_dispatch rehearsal runs it from any ref
  # without needing the release-pypi deployment approval, and it holds no
  # publishing credentials. The publish job below consumes the exact artifact
  # built here rather than rebuilding.
  build:
    name: Build distribution
    needs: [smithy, test]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      version: ${{ steps.version.outputs.version }}
    defaults:
      run:
        working-directory: python
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Verify tag is on main
        if: github.event_name == 'push'
        run: |
          git fetch origin main
          git merge-base --is-ancestor "$GITHUB_SHA" origin/main

      - name: Install uv
        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
        # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache

      - name: Set up Python
        run: uv python install 3.13

      - name: Extract version
        id: version
        env:
          EVENT_NAME: ${{ github.event_name }}
        run: |
          PY_VERSION=$(python3 -c "exec(open('src/basecamp/_version.py').read()); print(VERSION)")
          TOML_VERSION=$(python3 -c "import tomllib; print(tomllib.loads(open('pyproject.toml').read())['project']['version'])")
          if [ "$PY_VERSION" != "$TOML_VERSION" ]; then
            echo "::error::Version mismatch: _version.py ($PY_VERSION) != pyproject.toml ($TOML_VERSION)"
            exit 1
          fi
          if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
            echo "version=$PY_VERSION" >> $GITHUB_OUTPUT
            echo "Rehearsal for version: $PY_VERSION"
          else
            VERSION="${GITHUB_REF#refs/tags/v}"
            if [ "$PY_VERSION" != "$VERSION" ]; then
              echo "::error::Python version ($PY_VERSION) does not match tag version ($VERSION)"
              exit 1
            fi
            echo "version=$VERSION" >> $GITHUB_OUTPUT
            echo "Releasing version: $VERSION"
          fi

      - name: Build package
        run: uv build

      # PyPI rejects uploads whose metadata will not parse or whose long
      # description will not render, and that rejection would otherwise land
      # mid-release. twine check is the same validation, run before the tag
      # exists. Not --strict: this package currently ships no long_description
      # at all, which twine warns about and PyPI accepts, so --strict would fail
      # every release over a defect that belongs in pyproject.toml, not here.
      - name: Check distribution metadata
        run: uvx twine check dist/*

      - name: Dry-run build verification
        if: github.event_name == 'workflow_dispatch'
        run: |
          ls -la dist/
          echo "::notice::Dry run mode - not actually publishing"
          echo "Would publish: $(ls dist/*.tar.gz dist/*.whl)"

      - name: Upload distribution
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: python-dist
          path: python/dist/
          if-no-files-found: error
          retention-days: 7

  publish:
    name: Publish to PyPI
    needs: build
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      attestations: write
    environment: release-pypi
    steps:
      - name: Download distribution
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-dist
          path: python/dist/

      - name: Check if already published
        id: check-published
        env:
          VERSION: ${{ needs.build.outputs.version }}
        run: |
          # Query the PyPI JSON API for exact version match
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/basecamp-sdk/${VERSION}/json")
          if [ "$STATUS" = "200" ]; then
            echo "already_published=true" >> $GITHUB_OUTPUT
            echo "::notice::Version ${VERSION} already published to PyPI"
          else
            echo "already_published=false" >> $GITHUB_OUTPUT
          fi

      - name: Publish to PyPI
        if: steps.check-published.outputs.already_published != 'true'
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: python/dist/
          attestations: true