release-python.yml

# release-python — publish python/ to PyPI on a `python/v*` tag, via PyPI
# Trusted Publishing (OIDC): no token is stored anywhere. Configure the
# publisher once on PyPI (project `chtypes`, owner Wave-RF, repo chtypes,
# workflow release-python.yml, environment pypi).
name: release-python
on:
  push:
    tags: ["python/v*"]
permissions:
  contents: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
      - name: the tag and the package agree on the version
        run: |
          tag="${GITHUB_REF_NAME#python/v}"
          ver="$(cd python && uv run --no-project python -c 'import tomllib;print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')"
          [ "$tag" = "$ver" ] || { echo "::error::tag python/v$tag but pyproject says $ver"; exit 1; }
      - name: build sdist + wheel
        run: cd python && uv build
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with: { name: python-dist, path: python/dist/ }
  publish:
    needs: build
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with: { name: python-dist, path: dist/ }
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
  # A publish step exiting 0 does not mean anyone can install the package.
  # Measured on ts/v0.1.1 (issue #10): the job went green ~7 minutes before the
  # registry served the artifact, and for ~2 of those minutes the version
  # resolved to something that 404'd. Its own job, because `publish` downloads
  # an artifact into its workspace rather than checking the repository out.
  verify:
    needs: publish
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
      - name: it installs from PyPI and speaks the header's ABI revision
        run: scripts/verify-published.sh python "${GITHUB_REF_NAME#python/v}"