release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      target_branch:
        description: "The branch to release from"
        type: string
        required: true
      version_number:
        description: "The release version number (i.e. 1.0.0b1)"
        type: string
        required: true
      test_run:
        description: "Test run (Publish release as draft)"
        type: boolean
        default: true
        required: false
      deploy-to:
        type: choice
        description: Choose where to publish (test/prod)
        options:
          - PypiProd
          - PypiTest
        default: PypiTest

permissions: read-all

defaults:
  run:
    shell: bash

# will cancel previous workflows triggered by the same event and for the same ref for PRs or same SHA otherwise
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ contains(github.event_name, 'pull_request') && github.event.pull_request.head.ref || github.sha }}
  cancel-in-progress: true

jobs:

  test-and-check:
    name: Test and Check
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.deploy-to }}

    steps:
      - name: Check out target branch
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          ref: ${{ inputs.target_branch }}

      - name: "Set up Python & Hatch - 3.11"
        uses: ./.github/actions/setup-python-hatch
        with:
          python-version: "3.11"

      - name: Run tests
        run: hatch test
        shell: bash

      - name: Build artifacts
        run: hatch build
        shell: bash

      - name: Check artifacts
        run: hatch run build:check-all
        shell: bash


  update-version-and-create-changelog:
    name: Update Version and Create Changelog
    needs: [test-and-check]
    permissions:
      contents: write # this is the permission that allows creating a new release
    secrets: inherit
    uses: ./.github/workflows/release-prep.yml
    with:
      sha: ${{ github.sha }}
      version_number: ${{ inputs.version_number }}
      target_branch: ${{ inputs.target_branch }}
      test_run: ${{ inputs.test_run }}


  publish:
    name: Publish to PyPI
    if: ${{ !inputs.test_run }}
    needs: [test-and-check, update-version-and-create-changelog]
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.deploy-to }}
    permissions:
      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing

    steps:
      - name: Build Artifacts
        run: hatch build
        shell: bash

      - name: Publish Artifacts to PyPI Test
        if: inputs.deploy-to == 'PypiTest' && !inputs.test_run
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/

      - name: Publish artifacts to PyPI Prod
        if: inputs.deploy-to == 'PypiProd' && !inputs.test_run
        uses: pypa/gh-action-pypi-publish@release/v1