release.yml

name: Release

on:
  repository_dispatch:
    types: [openapi-updated]
  schedule:
    - cron: '0 6 * * *'
  workflow_dispatch:
    inputs:
      version_bump:
        description: 'patch | minor | major'
        required: false
        default: 'patch'

jobs:
  release:
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v7
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # Release tags are the ledger the gate below reads. The default shallow
          # checkout fetches none of them, which would make every run look like a
          # first release.
          fetch-depth: 0

      - uses: astral-sh/setup-uv@v7
        with:
          python-version: '3.12'
          enable-cache: true

      - name: Install deps
        run: uv sync --all-extras --dev

      - name: Regenerate SDK from live spec
        run: uv run python generate.py

      # Compare against the last RELEASED tag, never against the working tree.
      # "Did anything change since the last commit" is the wrong question: commit a
      # regeneration by hand and the next run sees a clean tree, reports success and
      # silently skips every publish step below, leaving the registry behind forever.
      # The tag cannot lie, because whatever is published is what that tag built.
      # The spec is the only generator input, so it is the only thing worth diffing;
      # a generator version bump changes the output without touching the spec and is
      # released deliberately through workflow_dispatch.
      - name: Is the published release built from the current spec?
        id: diff
        run: |
          LAST=$(git describe --tags --abbrev=0 --match 'v*' 2>/dev/null || true)
          if [ -z "$LAST" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git show "$LAST:specs/openapi.json" | jq -cS . > "$RUNNER_TEMP/released-spec.json"
          jq -cS . specs/openapi.json > "$RUNNER_TEMP/current-spec.json"
          if cmp -s "$RUNNER_TEMP/released-spec.json" "$RUNNER_TEMP/current-spec.json"; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Lint
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        run: uv run ruff check .

      - name: Typecheck
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        run: uv run mypy src/roxy_sdk/__init__.py

      - name: Test
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        run: uv run pytest tests/test_factory.py -v

      - name: Bump version in pyproject.toml and version.py
        id: bump
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        run: |
          python3 - <<'PY'
          import re
          bump = "${{ github.event.inputs.version_bump || 'patch' }}"
          pp = open("pyproject.toml").read()
          ver = re.search(r'^version = "(.+?)"', pp, re.M).group(1)
          parts = [int(x) for x in ver.split(".")]
          if bump == "major":   parts = [parts[0] + 1, 0, 0]
          elif bump == "minor": parts = [parts[0], parts[1] + 1, 0]
          else:                 parts = [parts[0], parts[1], parts[2] + 1]
          new_ver = ".".join(str(x) for x in parts)
          open("pyproject.toml", "w").write(
              re.sub(r'^version = ".+?"', f'version = "{new_ver}"', pp, count=1, flags=re.M)
          )
          open("src/roxy_sdk/version.py", "w").write(f'VERSION = "{new_ver}"\n')
          open("/tmp/new_version.txt", "w").write(new_ver)
          print(f"Bumped {ver} -> {new_ver} ({bump})")
          PY
          echo "version=$(cat /tmp/new_version.txt)" >> $GITHUB_OUTPUT

      - name: Build
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        run: uv build

      - name: Publish to PyPI
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          # a crashed run can publish and then fail before the git push lands, leaving the registry ahead of the repo; skip-existing makes the rerun converge instead of dying on the duplicate upload
          skip-existing: true

      - name: Commit, tag, push
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          VERSION=$(cat /tmp/new_version.txt)
          uv lock
          git add pyproject.toml uv.lock src/roxy_sdk/version.py specs/openapi.json src/roxy_sdk/factory.py
          git commit -m "release: v$VERSION"
          git tag "v$VERSION"
          git push --follow-tags

      - name: Create GitHub release
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        uses: softprops/action-gh-release@v3
        with:
          tag_name: v${{ steps.bump.outputs.version }}
          generate_release_notes: true
          make_latest: 'true'
          files: |
            dist/*.whl
            dist/*.tar.gz