release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g. 0.1.0 or v0.1.0 — leading v is stripped automatically)'
        required: true
        type: string
      branch:
        description: 'Branch to cut the release from (defaults to main)'
        required: false
        type: string
        default: main

jobs:
  validate-branch:
    name: Validate release branch
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check branch exists on origin
        env:
          GH_TOKEN: ${{ github.token }}
          BRANCH: ${{ inputs.branch }}
        run: |
          ENCODED_BRANCH="${BRANCH//\//%2F}"
          if ! gh api "repos/${{ github.repository }}/branches/${ENCODED_BRANCH}" --silent 2>/dev/null; then
            echo "::error::Branch '${BRANCH}' does not exist. Check for typos."
            exit 1
          fi
          echo "Branch '${BRANCH}' confirmed."

  test:
    name: Test (Python ${{ matrix.python-version }})
    needs: [validate-branch]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: true
      matrix:
        python-version: ["3.11", "3.12"]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          fetch-depth: 0  # required: hatch-vcs needs full tag history
          ref: ${{ inputs.branch }}

      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1

      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y graphviz libgraphviz-dev

      - name: Install dependencies
        run: uv sync --locked --all-extras --dev --python ${{ matrix.python-version }}

      - name: Run tests
        run: uv run --python ${{ matrix.python-version }} pytest -m "not postgres" --tb=short -q

  license-check:
    needs: [validate-branch]
    uses: ./.github/workflows/_license-check.yml
    with:
      branch: ${{ inputs.branch }}

  build:
    name: Build distribution
    needs: [test, license-check]
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write  # required to push the release tag
    outputs:
      version: ${{ steps.normalize.outputs.version }}
    steps:
      - name: Normalize version
        id: normalize
        run: |
          VERSION="${{ inputs.version }}"
          VERSION="${VERSION#v}"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          fetch-depth: 0  # required: hatch-vcs reads tag to set version
          ref: ${{ inputs.branch }}

      - name: Configure git identity
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Create local release tag
        run: git tag "v${{ steps.normalize.outputs.version }}"

      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1

      - name: Build wheel and sdist
        run: uv build

      - name: Guard against duplicate tag
        run: |
          if git ls-remote --tags origin "refs/tags/v${{ steps.normalize.outputs.version }}" | grep -q .; then
            echo "::error::Tag v${{ steps.normalize.outputs.version }} already exists on origin. Aborting."
            exit 1
          fi

      - name: Push release tag
        run: git push origin "v${{ steps.normalize.outputs.version }}"

      - name: Upload dist artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  publish-testpypi:
    name: Publish → TestPyPI
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment:
      name: testpypi
      url: https://test.pypi.org/p/orcapod
    permissions:
      id-token: write  # required for OIDC Trusted Publishing
    steps:
      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1

      - name: Download dist artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
        with:
          name: dist
          path: dist/

      - name: Publish to TestPyPI
        run: uv publish --publish-url https://test.pypi.org/legacy/ dist/*

  publish-pypi:
    name: Publish → PyPI
    needs: [build, publish-testpypi]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment:
      name: pypi
      url: https://pypi.org/p/orcapod
    permissions:
      id-token: write   # required for OIDC Trusted Publishing
      contents: write   # required for creating GitHub Release
    steps:
      - name: Install uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1

      - name: Download dist artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI
        run: uv publish dist/*

      - name: Create GitHub Release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
        with:
          tag_name: "v${{ needs.build.outputs.version }}"
          generate_release_notes: true
          files: dist/*

  linear-sync:
    name: Sync Linear release
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          fetch-depth: 0
      - name: Sync Linear release
        uses: linear/linear-release-action@c0cb8354a362c24c6d3e0948f37fd66d07588e3f  # v0
        with:
          access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
          command: sync
          version: "v${{ needs.build.outputs.version }}"

  linear-complete:
    name: Complete Linear release
    needs: [build, publish-pypi, linear-sync]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          fetch-depth: 0
      - name: Complete Linear release
        uses: linear/linear-release-action@c0cb8354a362c24c6d3e0948f37fd66d07588e3f  # v0
        with:
          access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
          command: complete
          version: "v${{ needs.build.outputs.version }}"