publish-pypi.yml

# Author: André Henrique (@mrhenrike) | União Geek — https://github.com/Uniao-Geek
#
# Auto-publish embedxpl to PyPI whenever the version in pyproject.toml
# is not yet available on PyPI.
#
# Flow:
#   push to master (this repo only) → read version → check PyPI → if new → build + tag + publish
#   push of v* tag → build + publish (direct release path)
#   workflow_dispatch → dry-run on TestPyPI
#
# Security model:
#   - Publishing uses OIDC Trusted Publisher ONLY (no API tokens in workflow)
#   - All publish jobs guard on github.repository to prevent fork execution
#   - The PyPI Trusted Publisher is bound to mrhenrike/EmbedXPL-Forge + this file + environment pypi
#
# One-time PyPI setup: https://pypi.org/manage/account/publishing/
#   PyPI project name : embedxpl
#   GitHub owner      : mrhenrike
#   GitHub repo       : EmbedXPL-Forge
#   Workflow file     : publish-pypi.yml
#   Environment       : pypi

name: publish-pypi

on:
  push:
    branches:
      - master
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: write    # needed to push version tag
  id-token: write    # required for OIDC Trusted Publishing

jobs:
  # ------------------------------------------------------------------ #
  # Check whether current version already exists on PyPI                #
  # ------------------------------------------------------------------ #
  version-check:
    name: "Check version vs PyPI"
    if: github.repository == 'mrhenrike/EmbedXPL-Forge'
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.read.outputs.version }}
      should_publish: ${{ steps.check.outputs.should_publish }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Read version from pyproject.toml
        id: read
        run: |
          VERSION=$(python - <<'EOF'
          import tomllib, pathlib
          data = tomllib.loads(pathlib.Path("pyproject.toml").read_text())
          print(data["project"]["version"])
          EOF
          )
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Current version: $VERSION"

      - name: Check if version is already on PyPI
        id: check
        run: |
          VERSION="${{ steps.read.outputs.version }}"
          HTTP=$(curl -s -o /dev/null -w "%{http_code}" \
            "https://pypi.org/pypi/embedxpl/$VERSION/json")
          echo "PyPI HTTP status for $VERSION: $HTTP"
          if [ "$HTTP" = "404" ]; then
            echo "should_publish=true" >> "$GITHUB_OUTPUT"
            echo "Version $VERSION is NOT on PyPI — will publish"
          else
            echo "should_publish=false" >> "$GITHUB_OUTPUT"
            echo "Version $VERSION already on PyPI — skipping publish"
          fi

  # ------------------------------------------------------------------ #
  # Build sdist + wheel                                                  #
  # ------------------------------------------------------------------ #
  build:
    name: "Build distribution"
    runs-on: ubuntu-latest
    needs: version-check
    if: |
      github.repository == 'mrhenrike/EmbedXPL-Forge' &&
      (needs.version-check.outputs.should_publish == 'true' || startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch')

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install build tools
        run: python -m pip install --upgrade pip build twine

      - name: Build sdist and wheel
        run: python -m build

      - name: Verify with twine check
        run: |
          python -m twine check dist/*
          echo "=== dist/ ==="
          ls -lh dist/

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist-${{ needs.version-check.outputs.version }}
          path: dist/
          retention-days: 30

  # ------------------------------------------------------------------ #
  # Create git tag for the new version (only on push to master)         #
  # ------------------------------------------------------------------ #
  tag-release:
    name: "Create version tag"
    runs-on: ubuntu-latest
    needs: [version-check, build]
    if: |
      github.repository == 'mrhenrike/EmbedXPL-Forge' &&
      needs.version-check.outputs.should_publish == 'true' &&
      github.event_name == 'push' &&
      github.ref == 'refs/heads/master'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Create and push tag v${{ needs.version-check.outputs.version }}
        run: |
          VERSION="${{ needs.version-check.outputs.version }}"
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          if git ls-remote --tags origin "refs/tags/v$VERSION" | grep -q "v$VERSION"; then
            echo "Tag v$VERSION already exists on remote — skipping tag creation"
          else
            git tag -a "v$VERSION" -m "EmbedXPL-Forge v$VERSION (auto-tagged by CI)"
            git push origin "v$VERSION"
            echo "Tagged v$VERSION"
          fi

  # ------------------------------------------------------------------ #
  # Publish to PyPI (production)                                        #
  # ------------------------------------------------------------------ #
  publish-pypi:
    name: "Publish to PyPI"
    runs-on: ubuntu-latest
    needs: [version-check, build]
    if: |
      github.repository == 'mrhenrike/EmbedXPL-Forge' &&
      (needs.version-check.outputs.should_publish == 'true' || startsWith(github.ref, 'refs/tags/v')) &&
      github.event_name != 'workflow_dispatch'
    environment:
      name: pypi
      url: https://pypi.org/project/embedxpl/${{ needs.version-check.outputs.version }}/

    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist-${{ needs.version-check.outputs.version }}
          path: dist/

      - name: Publish to PyPI via OIDC Trusted Publishing
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          print-hash: true
          verbose: true
          skip_existing: true

  # ------------------------------------------------------------------ #
  # Dry-run on TestPyPI (manual dispatch only)                          #
  # ------------------------------------------------------------------ #
  publish-testpypi:
    name: "Publish to TestPyPI (dry-run)"
    if: github.repository == 'mrhenrike/EmbedXPL-Forge' && github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    needs: [version-check, build]
    environment:
      name: testpypi
      url: https://test.pypi.org/project/embedxpl/

    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist-${{ needs.version-check.outputs.version }}
          path: dist/

      - name: Publish to TestPyPI via OIDC Trusted Publishing
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/
          print-hash: true
          verbose: true