release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: Existing v-prefixed tag to release
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  release:
    # Releases are built and published from the private repository only.
    # The public mirror carries the same workflow file, where a tag push
    # could never succeed (no release credentials); skip it there.
    if: github.repository == 'So3Lab/CADIR'
    name: Test, build, and release
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: write
    env:
      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}

    steps:
      - name: Check out tagged revision
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
        with:
          ref: ${{ env.RELEASE_TAG }}
          fetch-depth: 0

      - name: Install uv and Python
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          python-version: "3.12"
          enable-cache: true
          cache-python: true

      - name: Validate tag and project version
        shell: bash
        run: |
          set -euo pipefail
          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([ab]|rc)?[0-9]*$ ]]; then
            echo "Invalid release tag: $RELEASE_TAG" >&2
            exit 1
          fi
          project_version="$(uv run --python 3.12 --no-project python - <<'PY'
          import tomllib
          with open('pyproject.toml', 'rb') as file:
              print(tomllib.load(file)['project']['version'])
          PY
          )"
          if [[ "$RELEASE_TAG" != "v$project_version" ]]; then
            echo "Tag $RELEASE_TAG does not match pyproject version $project_version" >&2
            exit 1
          fi

      - name: Install locked dependencies
        run: uv sync --locked --group dev
      - name: Install headless rendering support
        run: sudo apt-get update && sudo apt-get install --yes xvfb


      - name: Compile package
        run: uv run python -m compileall -q src/simplecadapi

      - name: Run tests
        run: xvfb-run --auto-servernum uv run pytest test tests -q

      - name: Build wheel and source distribution
        run: uv build

      - name: Verify distributions
        run: uv run twine check dist/*
      - name: Build and verify Agent Skill archive
        run: |
          uv run python tools/auto_docs_gen.py --quiet
          uv run python tools/skillbuild.py --target omp
          uv run pytest test/test_skill_build.py -q
          tar -C skills -czf skills/simplecadapi.tar.gz simplecadapi-omp


      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          release_flags=()
          if [[ "$RELEASE_TAG" =~ (a|b|rc)[0-9]+$ ]]; then
            release_flags+=(--prerelease --latest=false)
          fi
          gh release create "$RELEASE_TAG" dist/* skills/simplecadapi.tar.gz \
            --verify-tag \
            --generate-notes \
            --title "$RELEASE_TAG" \
            "${release_flags[@]}"