release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  id-token: write

jobs:
  build-and-release:
    name: Validate, build, and publish release artifacts
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install build tooling
        run: python -m pip install --upgrade pip build

      - name: Install project with extras
        run: pip install '.[dev,test]'

      - name: Verify tag matches project version
        env:
          TAG_REF: ${{ github.ref }}
        run: |
          python - <<'PY'
          import os
          import tomllib
          from pathlib import Path

          tag = os.environ["TAG_REF"].split("/")[-1]
          project_version = tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"]
          expected_tag = f"v{project_version}"
          if tag != expected_tag:
              raise SystemExit(f"Tag {tag} does not match project version {expected_tag}")
          PY

      - name: Run tests
        run: pytest -q

      - name: Build distribution artifacts
        run: python -m build

      - name: Upload distribution artifacts
        uses: actions/upload-artifact@v4
        with:
          name: neuroca-dist-${{ github.ref_name }}
          path: dist

      - name: Publish GitHub release
        uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          generate_release_notes: true
          prerelease: ${{ contains(github.ref_name, '-rc') }}