release-python.yml

name: Publish Python SDK

on:
  release:
    types: [published]

concurrency:
  group: publish-python-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  build:
    name: Build and verify distributions
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          ref: ${{ github.event.release.tag_name }}

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: sdk/python/pyproject.toml

      - name: Validate release tag
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+)?$ ]]; then
            echo "Release tag must use vX.Y.Z or vX.Y.ZrcN: ${RELEASE_TAG}" >&2
            exit 1
          fi

          package_version="$({
            python - <<'PY'
          import pathlib
          import tomllib

          path = pathlib.Path("sdk/python/pyproject.toml")
          with path.open("rb") as stream:
              print(tomllib.load(stream)["project"]["version"])
          PY
          })"

          if [[ "${RELEASE_TAG#v}" != "${package_version}" ]]; then
            echo "Tag ${RELEASE_TAG} does not match package version ${package_version}" >&2
            exit 1
          fi

          git fetch --no-tags origin \
            +refs/heads/main:refs/remotes/origin/main
          if ! git merge-base --is-ancestor \
            HEAD refs/remotes/origin/main; then
            echo "Release tag must point to a commit on main" >&2
            exit 1
          fi

      - name: Install build dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e './sdk/python[dev]'

      - name: Check SDK
        run: |
          make sdk-check

      - name: Build and verify distributions
        id: distributions
        uses: ./.github/actions/python-distributions
        with:
          source-directory: sdk/python

      - name: Upload distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: python-distributions
          path: ${{ steps.distributions.outputs.dist-directory }}
          if-no-files-found: error
          retention-days: 7

  publish:
    name: Publish distributions to PyPI
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment:
      name: pypi
      url: https://pypi.org/project/akernel-sdk/
    permissions:
      id-token: write

    steps:
      - name: Download distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-distributions
          path: dist

      - name: Publish distributions
        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1