validate-and-publish.yml

name: Validate and Publish

on:
  pull_request:
    types: [closed]
    branches:
      - main

permissions:
  contents: write
  id-token: write

jobs:
  build:
    if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/v')
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    outputs:
      version: ${{ steps.extract-version.outputs.version }}
    steps:
      # https://github.com/actions/checkout
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Extract and validate version from branch name
        id: extract-version
        run: |
          VERSION="${GITHUB_HEAD_REF#release/}"
          if [[ ! "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Branch name does not match expected format release/vX.X.X (got: $GITHUB_HEAD_REF)"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Extracted version: $VERSION"

      - name: Setup Python
        uses: ./.github/actions/setup-python
        with:
          python-version: ${{ matrix.python-version }}

      - name: Check formatting
        run: make format-check

      - name: Run type checking
        run: make typecheck

  prepare-release:
    runs-on: ubuntu-latest
    needs: build
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    steps:
      # https://github.com/actions/checkout
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup Python
        uses: ./.github/actions/setup-python
        with:
          python-version: ${{ matrix.python-version }}

      - name: Build packages
        run: make build

      - name: Upload release artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: release-artifacts-${{ needs.build.outputs.version }}
          path: |
            packages/*/dist/
            .changeset/**
          retention-days: 7

  publish:
    name: Publish to PyPI
    needs: [build, prepare-release]
    environment: production
    runs-on:
      group: package-deploy # environment: production # require manual approval for production deployments

    steps:
      - name: Download release artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: release-artifacts-${{ needs.build.outputs.version }}
          path: .

      - name: Prepare packages for publishing
        run: |
          mkdir -p dist-to-publish

          if [ ! -f .changeset/.last_bumped_modules ]; then
            echo "No .last_bumped_modules file found, nothing to publish"
            exit 1
          fi

          echo "Packages to publish:"
          cat .changeset/.last_bumped_modules

          while IFS= read -r module || [ -n "$module" ]; do
            # Skip empty lines
            [ -z "$module" ] && continue

            dist_dir="packages/${module}/dist"
            if [ -d "$dist_dir" ]; then
              echo "Copying ${module} artifacts..."
              cp "${dist_dir}"/* dist-to-publish/
            else
              echo "Warning: dist directory not found for ${module}"
            fi
          done < .changeset/.last_bumped_modules

          echo "Artifacts to publish:"
          ls -la dist-to-publish/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
        with:
          packages-dir: dist-to-publish/
          repository-url: https://test.pypi.org/legacy/ # publishing to Test PyPI for now
          verbose: true
      
      - name: Create GitHub Release
        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
        with:
          tag_name: ${{ needs.build.outputs.version }}
          name: Release ${{ needs.build.outputs.version }}
          generate_release_notes: true
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Success
        run: |
          echo -e "\033[0;32m"
          echo "░██████╗██╗░░░██╗░█████╗░░█████╗░███████╗░██████╗░██████╗"
          echo "██╔════╝██║░░░██║██╔══██╗██╔══██╗██╔════╝██╔════╝██╔════╝"
          echo "╚█████╗░██║░░░██║██║░░╚═╝██║░░╚═╝█████╗░░╚█████╗░╚█████╗░"
          echo "░╚═══██╗██║░░░██║██║░░██╗██║░░██╗██╔══╝░░░╚═══██╗░╚═══██╗"
          echo "██████╔╝╚██████╔╝╚█████╔╝╚█████╔╝███████╗██████╔╝██████╔╝"
          echo "╚═════╝░░╚═════╝░░╚════╝░░╚════╝░╚══════╝╚═════╝░╚═════╝░"
          echo -e "\033[0m"