publish.yml

name: Release and publish to PyPI

on:
  push:
    tags:
      - "v*"

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  build:
    name: Build and verify distribution
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Install Python
        run: uv python install 3.12

      - name: Set up pnpm
        uses: pnpm/action-setup@v4
        with:
          run_install: false

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm

      - name: Verify release tag matches package version
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          PACKAGE_VERSION="$(uv run --no-project python -c \
            'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
          test "${RELEASE_TAG#v}" = "$PACKAGE_VERSION" || {
            echo "Release tag $RELEASE_TAG does not match package version $PACKAGE_VERSION"
            exit 1
          }

      - name: Install locked dependencies
        run: |
          uv sync --frozen --all-groups
          pnpm install --frozen-lockfile

      - name: Verify runtime version
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          uv run python - <<'PY'
          import os
          import windcode

          expected = os.environ["RELEASE_TAG"].removeprefix("v")
          if windcode.__version__ != expected:
              raise SystemExit(
                  f"windcode.__version__={windcode.__version__} does not match {expected}"
              )
          PY

      - name: Run quality checks
        run: |
          uv run ruff format --check .
          uv run ruff check .
          uv run pyright
          pnpm web:test
          pnpm web:build
          git diff --exit-code -- src/windcode/web/static

      - name: Build distributions
        run: uv build --no-sources

      - name: Verify distribution contents
        run: |
          uv run --with twine twine check dist/*
          uv run --no-project python - <<'PY'
          from pathlib import Path
          import zipfile

          wheel = next(Path("dist").glob("*.whl"))
          with zipfile.ZipFile(wheel) as archive:
              names = archive.namelist()
          required = (
              "windcode/__init__.py",
              "windcode/tui/styles.tcss",
              "windcode/web/static/index.html",
              "windcode/web/static/assets/app.js",
              "windcode/web/static/assets/app.css",
          )
          missing = [item for item in required if not any(name.endswith(item) for name in names)]
          if missing:
              raise SystemExit(f"Wheel is missing required files: {', '.join(missing)}")
          PY

      - name: Upload distributions
        uses: actions/upload-artifact@v4
        with:
          name: python-distributions
          path: dist/
          if-no-files-found: error

  release:
    name: Create GitHub release
    needs: [build]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Create or update GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release edit "$RELEASE_TAG" --title "$RELEASE_TAG"
          else
            gh release create "$RELEASE_TAG" --title "$RELEASE_TAG" --generate-notes
          fi

  publish:
    name: Publish distribution
    needs: [build, release]
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/windcode/
    permissions:
      id-token: write

    steps:
      - name: Download distributions
        uses: actions/download-artifact@v4
        with:
          merge-multiple: true
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true
          attestations: false

  publish-npm:
    name: Publish npm CLI wrapper
    needs: [publish]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up pnpm
        uses: pnpm/action-setup@v4
        with:
          run_install: false

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          cache: pnpm

      - name: Install locked dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify release versions
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          NPM_VERSION="$(node -p 'require("./package.json").version')"
          PYTHON_VERSION="$(sed -n 's/^version = "\([^"]*\)"/\1/p' pyproject.toml | head -n 1)"
          TAG_VERSION="${RELEASE_TAG#v}"
          test "$RELEASE_TAG" = "v$TAG_VERSION" \
            && test -n "$TAG_VERSION" \
            && test "$TAG_VERSION" = "$NPM_VERSION" \
            && test "$TAG_VERSION" = "$PYTHON_VERSION" || {
              echo "Version mismatch: tag=$TAG_VERSION npm=$NPM_VERSION python=$PYTHON_VERSION"
              exit 1
            }

      - name: Test CLI wrapper
        run: pnpm test

      - name: Verify package contents
        run: pnpm run pack:check

      - name: Publish package
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: "true"
        run: pnpm publish --access public --no-git-checks