release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  publish:
    name: publish
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: sdk/pyproject.toml

      - name: Install build and test dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install build twine
          python -m pip install -e ./sdk[dev]

      - name: Validate tag matches sdk package version
        shell: bash
        run: |
          set -euo pipefail
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PACKAGE_VERSION="$(python - <<'PY'
          import tomllib
          from pathlib import Path

          data = tomllib.loads(Path("sdk/pyproject.toml").read_text())
          print(data["project"]["version"])
          PY
          )"

          if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
            echo "Tag version ($TAG_VERSION) does not match sdk/pyproject.toml version ($PACKAGE_VERSION)."
            exit 1
          fi

      - name: Run unit tests
        working-directory: ./sdk
        run: pytest tests -m "not e2e"

      - name: Build package
        working-directory: ./sdk
        run: python -m build

      - name: Publish package
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
        run: python -m twine upload --non-interactive sdk/dist/*