release-python.yaml

name: release-python

on:
  push:
    tags:
      - "py-v*"
  workflow_dispatch:
    inputs:
      version_tag:
        description: "Python tag (py-vX.Y.Z)"
        required: true
        type: string

permissions:
  contents: write

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Validate tag
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            TAG="${{ inputs.version_tag }}"
          else
            TAG="${GITHUB_REF_NAME}"
          fi
          if [[ ! "${TAG}" =~ ^py-v([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
            echo "Expected py-vX.Y.Z, got: ${TAG}" >&2
            exit 1
          fi
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          echo "version=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"

      - name: Validate operation-id mappings
        run: |
          python scripts/check_operation_id_mappings.py

      - name: Install package with test dependencies
        run: |
          python -m pip install -e ".[dev]"

      - name: Run release readiness gate
        run: |
          bash scripts/release_readiness.sh --skip-node

      - name: Run live 71-op release gate
        if: ${{ secrets.AGENTICFLOW_PUBLIC_API_KEY != '' }}
        env:
          AGENTICFLOW_PUBLIC_API_KEY: ${{ secrets.AGENTICFLOW_PUBLIC_API_KEY }}
          NEXT_PUBLIC_BASE_API_URL: ${{ secrets.AGENTICFLOW_BASE_URL }}
        run: |
          bash scripts/release_readiness.sh --skip-tests --skip-node --live-ops-gate

      - name: Install build tooling
        run: |
          python -m pip install --upgrade pip
          python -m pip install build twine

      - name: Build distributions
        run: |
          python -m build

      - name: Check distributions
        run: |
          twine check dist/*

      - name: Publish to PyPI
        if: ${{ secrets.PYPI_API_TOKEN != '' }}
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: |
          twine upload dist/*