release.yml

name: Release

# Publishes to PyPI with Trusted Publishing (OIDC): no API token is stored in
# this repository. The publisher is registered and the `pypi` environment
# exists, so tagging is all a release needs.
#
# The claims this workflow presents, which must match the publisher at
# https://pypi.org/manage/project/forward-sdk/settings/publishing/ :
#
#   Owner:              forwardnetworks
#   Repository:         forward-python-sdk
#   Workflow name:      release.yml
#   Environment name:   pypi
#
# An `invalid-publisher` failure means those stopped matching. The error prints
# the claims actually presented; compare them against the list above. The build
# job runs first regardless, so a tag is still verified when an upload is
# refused.
#
# Releases up to 0.1.4 were uploaded manually and carry no attestations. PyPI
# does not backfill them onto published files, so attestations begin with the
# first release that goes through this workflow.

"on":
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: Build and verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Check the tag matches the package version
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          tag="${GITHUB_REF_NAME#v}"
          version="$(uv run python -c 'import forward_sdk; print(forward_sdk.__version__)')"
          if [ "$tag" != "$version" ]; then
            echo "tag $tag does not match __version__ $version" >&2
            exit 1
          fi

      - name: Run the test suite
        run: |
          uv sync --all-groups
          uv run pytest -q

      - run: uv build
      - run: uvx twine check dist/*

      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/forward-sdk/
    permissions:
      id-token: write  # OIDC token for Trusted Publishing
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          attestations: true