dev-release.yml

name: Dev Release

on:
  push:
    branches: [main]
  workflow_dispatch:  # Allow manual triggering

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  dev-release:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install uv
        run: |
          pip install uv

      - name: Compute version from git
        id: check_version
        run: |
          # Trigger: the push of a release PR's bump commit reaches this
          #   workflow before the release recipe pushes the vX.Y.Z tag.
          # Why: dunamai would see an untagged commit and emit a dev version,
          #   publishing the stable release content as a spurious dev artifact
          #   under the previous release line.
          # Outcome: release-bump commits are recognized by the recipe's fixed
          #   commit subject (the same key the recipe itself uses to locate the
          #   commit after rebase-merge) and skipped; the Release workflow
          #   publishes them from the tag.
          SUBJECT=$(git log -1 --pretty=%s)
          if [[ "$SUBJECT" =~ ^chore:\ update\ version\ to\ .*\ release$ ]]; then
            echo "is_dev=false" >> $GITHUB_OUTPUT
            echo "version=" >> $GITHUB_OUTPUT
            echo "Release bump commit detected ('$SUBJECT'), skipping dev release"
            exit 0
          fi
          # The release automation hardcodes the last stable release into
          # basic_memory.__version__, so importing the source tree always
          # reports that release and the old gate skipped every dev publish.
          # Derive the version from the VCS state instead, exactly as
          # uv-dynamic-versioning would. --no-metadata drops the +commit
          # local segment, which PyPI rejects on upload.
          VERSION=$(uvx dunamai from git --style pep440 --bump --no-metadata)
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          if [[ "$VERSION" == *"dev"* ]]; then
            echo "is_dev=true" >> $GITHUB_OUTPUT
            echo "Dev version detected: $VERSION"
          else
            echo "is_dev=false" >> $GITHUB_OUTPUT
            echo "Release version detected: $VERSION, skipping dev release"
          fi

      - name: Build
        if: steps.check_version.outputs.is_dev == 'true'
        run: |
          # Bypass VCS version computation in the build backend so the
          # artifact carries the same metadata-free version the gate saw.
          UV_DYNAMIC_VERSIONING_BYPASS="${{ steps.check_version.outputs.version }}" uv build

      # Publishes via PyPI trusted publishing (OIDC) — the PYPI_TOKEN secret no
      # longer exists (stable releases attest via the release.yml trusted
      # publisher). Requires a PyPI trusted-publisher registration for
      # dev-release.yml on the basic-memory project.
      - name: Publish dev version to PyPI
        if: steps.check_version.outputs.is_dev == 'true'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true  # Don't fail if version already exists