release.yml

name: Release

on:
  release:
    types: [published]
  # v0.51.5 — workflow_dispatch supports the cascade pattern from
  # publish-on-tag.yml. Tag pushes use GITHUB_TOKEN to create the
  # release (which doesn't cascade) and then explicitly fire this
  # workflow via `gh workflow run` (which DOES cascade via GITHUB_TOKEN).
  workflow_dispatch:
    inputs:
      version:
        description: "Version to publish (defaults to pyproject.toml)"
        required: false
        default: ''

permissions:
  contents: read
  id-token: write
  # v0.51.6 — actions: write so this workflow can fire the registry
  # publish via gh workflow run after PyPI succeeds.
  actions: write

jobs:
  build:
    name: Build release artifacts
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip

      - name: Build and verify distributions
        run: |
          python -m pip install --upgrade pip
          python -m pip install build twine
          python -m build
          python -m twine check dist/*

      - name: Upload distributions
        uses: actions/upload-artifact@v7
        with:
          name: release-dist
          path: dist/*

  publish-pypi:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/atomadic-forge/
    if: |
      (github.event_name == 'release' && !github.event.release.prerelease)
      || github.event_name == 'workflow_dispatch'
    steps:
      - name: Download distributions
        uses: actions/download-artifact@v8
        with:
          name: release-dist
          path: dist

      - name: Publish distributions
        uses: pypa/gh-action-pypi-publish@release/v1

      - name: Trigger MCP Registry publish (sequential — only after PyPI lands)
        # The registry validates against PyPI; firing it before PyPI
        # propagates returns 404. Only fire after our PyPI publish
        # step has succeeded — guaranteed by needs:[build] + this
        # step's position in publish-pypi.
        env:
          GH_TOKEN: ${{ github.token }}
          V: ${{ github.event.inputs.version || github.event.release.tag_name }}
        run: |
          set +e
          # Strip leading v if it's a tag name.
          v="${V#v}"
          gh workflow run mcp-registry-publish.yml \
            --repo atomadictech/atomadic-forge \
            -f version="$v" \
            || echo "::warning::registry dispatch failed (worker can be triggered manually)"
          echo "registry publish dispatched for v$v"
          exit 0