create-release.yml

name: Create Release & Publish

on:
  workflow_dispatch:
    inputs:
      version_type:
        description: "Version type"
        required: true
        default: "patch"
        type: choice
        options:
          - major
          - minor
          - patch

jobs:
  create-release:
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    outputs:
      new_version: ${{ steps.new-version.outputs.new_version }}
      branch_name: ${{ steps.new-version.outputs.branch_name }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 0
          # ACTIONS_TOKEN required to push to protected main branch
          token: ${{ secrets.ACTIONS_TOKEN || github.token }}

      - name: Setup Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.14"

      - name: Install uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0

      - name: Get current version
        id: current-version
        run: |
          CURRENT_VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT

      - name: Calculate new version
        id: new-version
        run: |
          CURRENT_VERSION="${{ steps.current-version.outputs.current_version }}"
          VERSION_TYPE="${{ inputs.version_type }}"

          IFS='.' read -r major minor patch <<< "$CURRENT_VERSION"

          case "$VERSION_TYPE" in
            major)
              major=$((major + 1))
              minor=0
              patch=0
              ;;
            minor)
              minor=$((minor + 1))
              patch=0
              ;;
            patch)
              patch=$((patch + 1))
              ;;
          esac

          NEW_VERSION="${major}.${minor}.${patch}"
          BRANCH_NAME="release/${NEW_VERSION}"

          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
          echo "New version: $NEW_VERSION"
          echo "Branch name: $BRANCH_NAME"

      - name: Check if branch already exists
        run: |
          BRANCH_NAME="${{ steps.new-version.outputs.branch_name }}"

          # Check if branch exists locally or remotely
          if git show-ref --verify --quiet refs/heads/$BRANCH_NAME || git show-ref --verify --quiet refs/remotes/origin/$BRANCH_NAME; then
            echo "❌ Branch $BRANCH_NAME already exists"
            exit 1
          else
            echo "✅ Branch $BRANCH_NAME does not exist, proceeding..."
          fi

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Update main branch version
        run: |
          CURRENT_VERSION="${{ steps.current-version.outputs.current_version }}"
          NEW_VERSION="${{ steps.new-version.outputs.new_version }}"

          echo "Updating main branch version from $CURRENT_VERSION to $NEW_VERSION"

          # Update version in pyproject.toml
          sed -i "s/^version = \"$CURRENT_VERSION\"/version = \"$NEW_VERSION\"/" pyproject.toml

          # Update lock file
          uv sync --all-extras

          # Commit and push to main
          git add pyproject.toml
          git commit -m "Release v$NEW_VERSION"
          git push origin main

      - name: Create release branch
        run: |
          BRANCH_NAME="${{ steps.new-version.outputs.branch_name }}"

          echo "Creating release branch: $BRANCH_NAME"

          # Create new branch from updated main
          git checkout -b "$BRANCH_NAME"

          # Push the release branch
          git push origin "$BRANCH_NAME"

          echo "✅ Release branch created: $BRANCH_NAME"

  create-tag:
    needs: create-release
    permissions:
      contents: write
    uses: RoboFinSystems/robosystems/.github/workflows/tag-release.yml@main
    with:
      branch_ref: ${{ needs.create-release.outputs.branch_name }}
      product_name: 'RoboSystems Python SDK'
      project_kind: 'Python SDK'
    secrets: inherit

  # PyPI's trusted publisher is pinned to this workflow file and the production
  # environment, whose protection rules (required reviewer, deployment
  # branches) gate every publish. The approval prompt lands on this run.
  publish:
    needs: [create-release, create-tag]
    runs-on: ubuntu-24.04
    environment: production

    permissions:
      contents: read
      id-token: write # For PyPI trusted publishing

    steps:
      - name: Checkout release tag
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.create-tag.outputs.tag_name }}

      - name: Setup Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.14"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install build twine

      - name: Get current version
        id: current-version
        run: |
          CURRENT_VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
          echo "Current version: $CURRENT_VERSION"

      - name: Verify the checkout is the released version
        run: |
          EXPECTED="${{ needs.create-release.outputs.new_version }}"
          ACTUAL="${{ steps.current-version.outputs.current_version }}"

          if [ "$ACTUAL" != "$EXPECTED" ]; then
            echo "❌ Checked out version $ACTUAL, expected $EXPECTED"
            exit 1
          fi
          echo "✅ Checked out the released version $ACTUAL"

      - name: Build package
        run: python -m build

      - name: Check if version exists on PyPI
        id: check-pypi
        run: |
          VERSION="${{ steps.current-version.outputs.current_version }}"
          PACKAGE_NAME="robosystems-client"

          # Check if version exists on PyPI
          if curl -s "https://pypi.org/pypi/${PACKAGE_NAME}/${VERSION}/json" | grep -q "\"version\""; then
            echo "❌ Version ${VERSION} already exists on PyPI"
            echo "version_exists=true" >> $GITHUB_OUTPUT
            exit 1
          else
            echo "✅ Version ${VERSION} does not exist on PyPI, safe to publish"
            echo "version_exists=false" >> $GITHUB_OUTPUT
          fi

      - name: Publish to PyPI
        if: steps.check-pypi.outputs.version_exists == 'false'
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          verbose: true

  create-summary:
    needs: [create-release, create-tag, publish]
    if: always()
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Create summary
        run: |
          echo "## 🚀 Python SDK Release Created" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Version:** ${{ needs.create-tag.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "**Tag:** \`${{ needs.create-tag.outputs.tag_name }}\`" >> $GITHUB_STEP_SUMMARY
          echo "**Branch:** \`${{ needs.create-release.outputs.branch_name }}\`" >> $GITHUB_STEP_SUMMARY
          echo "**Type:** ${{ inputs.version_type }}" >> $GITHUB_STEP_SUMMARY
          echo "**Publish:** ${{ needs.publish.result }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Release URL:** ${{ needs.create-tag.outputs.release_url }}" >> $GITHUB_STEP_SUMMARY

          if [ "${{ needs.publish.result }}" != "success" ]; then
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "The version and tag are cut but the package is not on PyPI. Fix the cause, then **Re-run failed jobs** on this run; a new release is only needed when the code itself is at fault." >> $GITHUB_STEP_SUMMARY
          fi