name: Release

# Tag-driven release. The former ci-cd.yml carried a second, overlapping
# build-and-publish job triggered on `release: published`, so a tag push followed
# by a published release ran two independent PyPI uploads. This is now the only
# publish path.

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write        # create the GitHub release
  id-token: write        # PyPI trusted publishing -- no long-lived token needed

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Sync environment
        run: uv sync --locked --extra dev --extra test

      - name: Verify the tag matches the packaged version
        # bump-my-version has silently missed parsl_ephemeral_provider/__init__.py
        # before -- its [tool.bumpversion] search string drifted out of sync, so
        # v0.6.0 shipped with __version__ == "0.1.0". Catch that here rather than
        # on PyPI, where a version can never be reused.
        run: |
          tag="${GITHUB_REF_NAME#v}"
          pkg="$(uv run python -c 'import parsl_ephemeral_provider as p; print(p.__version__)')"
          if [ "$tag" != "$pkg" ]; then
            echo "::error::tag $GITHUB_REF_NAME disagrees with __version__ $pkg"
            exit 1
          fi
          echo "Tag and package version agree: $pkg"

      - name: Run unit and security tests
        run: uv run pytest tests/unit tests/security -q

      - name: Build package
        run: uv build

      - name: Check package metadata
        run: uvx twine check dist/*

      - name: Create GitHub release
        # actions/create-release and actions/upload-release-asset are both
        # archived and unmaintained; gh uploads the artifacts in one call.
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "$GITHUB_REF_NAME" \
            --title "Release $GITHUB_REF_NAME" \
            --generate-notes \
            dist/*

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true