# Publishes the paperspec Python package to this instance's PyPI registry when a version tag (v0.1.1) is
# pushed; see deploy/README.md for the secrets it needs and how to install from the registry.
# The package version comes from the tag through setuptools-scm, so the job refuses to upload unless the
# built version equals the tag. Run it by hand only on a tag, for example after adding the secrets.
name: publish
on:
  push:
    tags: ["v*"]
  workflow_dispatch:
permissions:
  contents: read
concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false
defaults:
  run:
    shell: bash
jobs:
  publish:
    runs-on: linux-base
    container:
      image: git.scient.ing/infra/linux-base:26.10.7
    timeout-minutes: 30
    env:
      REGISTRY: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/pypi
    steps:
      - name: Require a version tag
        run: |
          if [[ "$GITHUB_REF" != refs/tags/v* ]]; then
            echo "Publish runs on a version tag such as v0.1.1; $GITHUB_REF is not one."
            exit 1
          fi
      # The whole history, so setuptools-scm finds the tag and computes the release version.
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Check the repository
        run: pixi run --locked check
      - name: Build the sdist and wheel
        run: pixi run --locked -e dev dist
      - name: Confirm the built version is the tag
        run: |
          tag="${GITHUB_REF_NAME#v}"
          wheels=(dist/paperspec-*.whl)
          built="$(basename "${wheels[0]}" | cut -d- -f2)"
          echo "tag $GITHUB_REF_NAME, built $built"
          if [ "${#wheels[@]}" -ne 1 ] || [ "$built" != "$tag" ]; then
            echo "The built version is not the tag's; is the tag on the commit this job checked out?"
            exit 1
          fi
      - name: Check the package metadata
        run: pixi run --locked -e dev twine check --strict dist/*
      # --skip-existing makes a rerun on the same tag succeed instead of failing on the files already there.
      - name: Upload to the package registry
        env:
          TWINE_USERNAME: ${{ secrets.PACKAGE_USER }}
          TWINE_PASSWORD: ${{ secrets.PACKAGE_TOKEN }}
          TWINE_REPOSITORY_URL: ${{ env.REGISTRY }}
        run: |
          if [ -z "$TWINE_USERNAME" ] || [ -z "$TWINE_PASSWORD" ]; then
            echo "The secrets PACKAGE_USER and PACKAGE_TOKEN are not set; deploy/README.md says how."
            exit 1
          fi
          pixi run --locked -e dev twine upload --non-interactive --skip-existing dist/*
          echo "Published to $REGISTRY: pip install --index-url $REGISTRY/simple/ paperspec"