release.yml

name: Release SDK

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Package version to publish (must match setup.py/pyproject.toml)'
        required: true
        type: string
      publish_to_pypi:
        description: 'Publish to PyPI'
        required: false
        type: boolean
        default: false
      create_tag:
        description: 'Create git tag and GitHub release'
        required: false
        type: boolean
        default: true

jobs:
  publish:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: read
    steps:
      - name: Check user permissions
        run: |
          PERMISSION=$(curl -s -H "Authorization: Bearer ${{ github.token }}" \
            "https://api.github.com/repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission" | \
            jq -r '.permission')
          
          if [ "$PERMISSION" != "admin" ] && [ "$PERMISSION" != "maintain" ]; then
            echo "❌ Error: Only repository admins and maintainers can trigger this workflow."
            echo "   Current user: ${{ github.actor }}"
            echo "   Permission level: $PERMISSION"
            echo "   Required: admin or maintain"
            exit 1
          fi
          
          echo "✅ User ${{ github.actor }} has permission level: $PERMISSION"

      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.13'
          cache: 'pip'

      - name: Install build dependencies
        run: |
          python -m pip install --upgrade pip
          pip install build wheel twine

      - name: Verify version
        run: |
          EXPECTED_VERSION="${{ inputs.version }}"
          ACTUAL_VERSION=$(python -c "import setup; print(setup.VERSION)" 2>/dev/null || python -c "import tomli; print(tomli.load(open('pyproject.toml'))['project']['version'])" 2>/dev/null || echo "")
          
          if [ -z "$ACTUAL_VERSION" ]; then
            echo "⚠️  Warning: Could not determine version from setup.py or pyproject.toml"
          elif [ "$EXPECTED_VERSION" != "$ACTUAL_VERSION" ]; then
            echo "⚠️  Warning: Input version ($EXPECTED_VERSION) does not match package version ($ACTUAL_VERSION)"
            echo "   Proceeding with package version: $ACTUAL_VERSION"
          else
            echo "✅ Version verified: $ACTUAL_VERSION"
          fi

      - name: Build package
        run: |
          python -m build

      - name: Check package
        run: |
          twine check dist/*

      - name: Publish to PyPI
        if: inputs.publish_to_pypi == true
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: |
          if [ -z "$TWINE_PASSWORD" ]; then
            echo "❌ PYPI_API_TOKEN secret is not set. Skipping publish."
            echo "   To enable publishing, configure PYPI_API_TOKEN as a secret in GitHub:"
            echo "   - Go to Settings → Secrets and variables → Actions"
            echo "   - Add PYPI_API_TOKEN (get token from https://pypi.org/manage/account/token/)"
            echo "   - Token must be a project-scoped API token with 'Upload packages' permission"
            exit 1
          fi
          
          # Verify token format (PyPI tokens start with 'pypi-' for legacy tokens or are long alphanumeric strings)
          TOKEN_LENGTH=${#TWINE_PASSWORD}
          if [ "$TOKEN_LENGTH" -lt 20 ]; then
            echo "⚠️  Warning: Token appears to be too short (${TOKEN_LENGTH} characters)"
            echo "   PyPI API tokens are typically 40+ characters"
          fi
          
          echo "📦 Uploading package to PyPI..."
          echo "   Package files:"
          ls -lh dist/*
          
          # Use verbose mode for better error messages
          if twine upload --verbose dist/*; then
            echo "✅ Successfully uploaded package to PyPI"
          else
            echo "❌ Failed to upload package to PyPI"
            echo ""
            echo "Common issues:"
            echo "  1. Token is invalid or expired - Generate a new token at https://pypi.org/manage/account/token/"
            echo "  2. Token doesn't have 'Upload packages' permission - Check token scope"
            echo "  3. Token is for TestPyPI instead of PyPI - Use correct token for production PyPI"
            echo "  4. Package version already exists - PyPI doesn't allow overwriting existing versions"
            echo "  5. Token has extra whitespace - Check secret value in GitHub settings"
            echo ""
            echo "To debug:"
            echo "  - Check token at https://pypi.org/manage/account/token/"
            echo "  - Verify token has 'Upload packages' scope for this project"
            echo "  - Ensure package version doesn't already exist on PyPI"
            exit 1
          fi

      - name: Create Git tag
        if: inputs.publish_to_pypi == true && inputs.create_tag == true
        id: tag
        run: |
          VERSION="${{ inputs.version }}"
          # Ensure version starts with 'v'
          if [[ ! "$VERSION" =~ ^v ]]; then
            VERSION="v$VERSION"
          fi
          
          # Check if tag already exists
          if git rev-parse "$VERSION" >/dev/null 2>&1; then
            echo "ℹ️  Tag $VERSION already exists, skipping tag creation"
            echo "✅ Using existing tag: $VERSION"
          else
            git config user.name "GitHub Actions"
            git config user.email "actions@github.com"
            git tag -a "$VERSION" -m "Release $VERSION"
            git push origin "$VERSION"
            echo "✅ Created and pushed tag: $VERSION"
          fi
          
          echo "tag=$VERSION" >> $GITHUB_OUTPUT

      - name: Create GitHub Release
        if: inputs.publish_to_pypi == true && inputs.create_tag == true
        run: |
          VERSION="${{ steps.tag.outputs.tag }}"
          
          # Check if release already exists
          RELEASE_ID=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            "https://api.github.com/repos/${{ github.repository }}/releases/tags/$VERSION" | \
            jq -r '.id // empty')
          
          if [ -n "$RELEASE_ID" ] && [ "$RELEASE_ID" != "null" ]; then
            echo "ℹ️  Release for tag $VERSION already exists (ID: $RELEASE_ID), skipping release creation"
            echo "✅ Using existing release: $VERSION"
          else
            # Create new release
            RELEASE_BODY="## Release $VERSION"$'\n\n'"See [CHANGELOG.md](CHANGELOG.md) for detailed release notes and version history."
            
            curl -X POST \
              -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
              -H "Accept: application/vnd.github.v3+json" \
              "https://api.github.com/repos/${{ github.repository }}/releases" \
              -d "$(jq -n \
                --arg tag "$VERSION" \
                --arg name "Release $VERSION" \
                --arg body "$RELEASE_BODY" \
                '{tag_name: $tag, name: $name, body: $body, draft: false, prerelease: false}')"
            echo "✅ Created GitHub release: $VERSION"
          fi

      - name: Upload build artifacts
        if: inputs.publish_to_pypi == false
        uses: actions/upload-artifact@v4
        with:
          name: python-package
          path: dist/*
          retention-days: 30