publish.yml

name: Publish to PyPI

on:
  workflow_dispatch:
  push:
    tags:
      - 'v*.*.*'

jobs:
  publish:
    name: Build and publish
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Show tool versions
        run: |
          python --version
          pip --version

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Lint
        run: ruff check .

      - name: Typecheck
        run: mypy stableops/ tests/

      - name: Test
        run: pytest

      - name: Build
        run: pip install build && python -m build

      - name: Verify tag matches package version
        if: startsWith(github.ref, 'refs/tags/')
        shell: bash
        run: |
          PACKAGE_VERSION="$(python -c "import tomllib; f=open('pyproject.toml','rb'); print(tomllib.load(f)['project']['version'])")"
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          if [ "$PACKAGE_VERSION" != "$TAG_VERSION" ]; then
            echo "Tag v${TAG_VERSION} does not match pyproject.toml version ${PACKAGE_VERSION}."
            exit 1
          fi

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@v1.12.4