publish.yml

name: Publish to PyPI

# Triggers on a pushed tag matching v*.*.* (e.g. v0.1.0).
# Uses PyPI Trusted Publishing (OIDC) — no API token stored in GitHub.
#
# Pre-flight setup (do this ONCE on PyPI before the first tag push):
#   1. Go to https://pypi.org/manage/account/publishing/
#   2. Add a "Pending Publisher" with:
#        Project name:  wefact-mcp
#        Owner:         NickAldewereld
#        Repository:    wefact-mcp
#        Workflow:      publish.yml
#        Environment:   pypi
#   3. After the first successful publish, the project is bound and
#      future tag pushes auto-publish.

on:
  push:
    tags: ["v*.*.*"]
  workflow_dispatch:
    inputs:
      version_check:
        description: "Confirm the tag/version (sanity check)"
        required: true

permissions:
  contents: read

jobs:
  test:
    name: Test before publish
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install
        run: pip install --no-cache-dir -e ".[dev]"
      - name: Run tests
        run: pytest -q

  build:
    name: Build distributions
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install build tools
        run: pip install --no-cache-dir build twine

      - name: Verify tag matches pyproject version
        run: |
          TAG="${GITHUB_REF#refs/tags/v}"
          PKG_VERSION=$(python -c "import tomllib, pathlib; print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")
          if [ "$TAG" != "$PKG_VERSION" ]; then
            echo "::error::Tag v$TAG does not match pyproject version $PKG_VERSION"
            exit 1
          fi
          echo "Version check passed: $PKG_VERSION"

      - name: Build distributions
        run: python -m build

      - name: Validate metadata
        run: twine check dist/*

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/

  publish-pypi:
    name: Publish to PyPI (trusted publishing)
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/wefact-mcp
    permissions:
      id-token: write  # required for OIDC trusted publishing
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          attestations: true

  github-release:
    name: Create GitHub release
    needs: publish-pypi
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/

      - name: Extract changelog excerpt
        id: changelog
        run: |
          TAG="${GITHUB_REF#refs/tags/v}"
          # Pull the section for this version out of CHANGELOG.md
          awk "/^## \[${TAG}\]/{flag=1; next} /^## \[/{flag=0} flag" CHANGELOG.md > release_notes.md || true
          if [ ! -s release_notes.md ]; then
            echo "Release v${TAG}" > release_notes.md
          fi

      - name: Create GitHub release
        uses: softprops/action-gh-release@v3
        with:
          files: dist/*
          body_path: release_notes.md
          generate_release_notes: false