release-python.yml

name: Release Python client

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to publish, matching clients/python/pyproject.toml"
        required: true
        type: string
      repository:
        description: "Package index"
        required: true
        default: "testpypi"
        type: choice
        options:
          - testpypi
          - pypi
      dry_run:
        description: "Build and validate without publishing"
        required: true
        default: true
        type: boolean

permissions:
  contents: read

jobs:
  build:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ inputs.version }}
    defaults:
      run:
        working-directory: clients/python
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Verify version input
        run: |
          set -Eeuo pipefail
          python -m pip install -U packaging
          # Validate PEP 440 (accepts 0.2.0, 0.2.0rc1, 0.2.0.dev1, 0.2.0a1, 0.2.0.post1, ...).
          # Reject hyphenated forms like 0.2.0-dev that PyPI normalises into something
          # the operator did not type, since "version input == pyproject.toml" then
          # silently disagrees with what the wheel publishes as.
          python -c "
          import os, sys
          from packaging.version import Version, InvalidVersion
          v = os.environ['VERSION']
          try:
              parsed = Version(v)
          except InvalidVersion as e:
              sys.exit(f'invalid PEP 440 version: {v!r} ({e})')
          if str(parsed) != v:
              sys.exit(f'version {v!r} is not in PEP 440 canonical form (would normalise to {str(parsed)!r})')
          "
          actual=$(python - <<'PY'
          import tomllib
          print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])
          PY
          )
          test "$actual" = "$VERSION" || {
            echo "version input $VERSION != pyproject.toml $actual"
            exit 1
          }

      - name: Build distribution
        run: |
          set -Eeuo pipefail
          python -m pip install -U build twine
          python -m build
          python -m twine check dist/*

      - name: Verify built wheel installs
        run: |
          set -Eeuo pipefail
          python -m venv /tmp/pgque-python-wheel-check
          . /tmp/pgque-python-wheel-check/bin/activate
          python -m pip install dist/*.whl
          python - <<'PY'
          import importlib.metadata as md
          import pgque
          assert md.version('pgque-py')
          assert hasattr(pgque, 'PgqueClient')
          PY

      - name: Upload distributions
        if: ${{ !inputs.dry_run }}
        uses: actions/upload-artifact@v4
        with:
          name: python-dist
          path: clients/python/dist/*
          if-no-files-found: error

  publish-testpypi:
    if: ${{ !inputs.dry_run && inputs.repository == 'testpypi' }}
    needs: build
    runs-on: ubuntu-latest
    environment: testpypi
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: python-dist
          path: dist

      - name: Publish to TestPyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist
          repository-url: https://test.pypi.org/legacy/

  publish-pypi:
    if: ${{ !inputs.dry_run && inputs.repository == 'pypi' }}
    needs: build
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: python-dist
          path: dist

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist