python-publish.yml

name: python-publish

# Publishes to PyPI via OIDC trusted publishing — no long-lived tokens.
#
# Prerequisites (one-time):
#   1. PyPI account exists at https://pypi.org/.
#   2. On PyPI: Publishing → Add a new pending publisher:
#        Project name: missioninbox
#        Owner: MissionInbox
#        Repository name: sdk
#        Workflow name: python-publish.yml
#        Environment name: pypi
#   3. In this repo: Settings → Environments → New environment → `pypi`
#      (no protection rules required for a first release).

on:
  push:
    tags:
      - 'python-v*'

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write   # required for PyPI OIDC trusted publishing
      contents: read
    defaults:
      run:
        working-directory: packages/python
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Verify tag matches package version
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#python-v}"
          PKG_VERSION=$(python -c "import re, pathlib; text = pathlib.Path('pyproject.toml').read_text(); print(re.search(r'^version *= *\"([^\"]+)\"', text, re.M).group(1))")
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match pyproject.toml version $PKG_VERSION"
            exit 1
          fi

      - name: Install build tools
        run: python -m pip install --upgrade build

      - name: Build sdist and wheel
        run: python -m build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: packages/python/dist/