shry-deploy.yml

name: Publish SHRY distributions to PyPI

# Trigger only when tags that start with "v" are pushed (e.g., v0.1.0)
on:
  push:
    tags:
      - 'v*'

jobs:
  # validate tag
  validate_tag:
    # Run only if this repository is rc
    if: startsWith(github.ref, 'refs/tags/v') && github.repository == 'shry-project/SHRY'
    runs-on: ubuntu-latest
    steps:
      # Check out the repository
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # Set up Python to run the validator
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      # Install dependencies for version validation
      - name: Install validator deps
        run: python -m pip install --upgrade pip packaging

      - name: tag must be on rc
        shell: bash
        run: |
          git fetch origin rc
          if git merge-base --is-ancestor "$GITHUB_SHA" origin/rc; then
            echo "Tag is on rc."
          else
            echo "Tag is not on rc."
            exit 1
          fi

      # Extract TAG and strip the leading "v" for PEP 440 validation
      - name: Extract TAG and VERSION
        shell: bash
        run: |
          TAG="${GITHUB_REF_NAME:-$(git describe --tags --abbrev=0 || true)}"
          if [ -z "$TAG" ]; then
            echo "This run is not on a tag. Aborting."
            exit 1
          fi
          if [[ ! "$TAG" =~ ^v[^.] ]]; then
            echo "Tag must start with 'v' and not 'v.' (got: $TAG)"
            exit 1
          fi
          echo "TAG=$TAG" >> $GITHUB_ENV
          echo "VERSION=${TAG#v}" >> $GITHUB_ENV

      # Validate against PEP 440 and enforce canonical form (e.g., v1.0rc1 not v1.0RC1)
      - name: Validate tag against PEP 440 (canonical)
        run: |
          python - <<'PY'
          import os, sys
          from packaging.version import Version, InvalidVersion

          tag = os.environ["TAG"]
          ver = os.environ["VERSION"]

          try:
              parsed = Version(ver)
          except InvalidVersion as e:
              print(f"Invalid PEP 440 version in tag '{tag}': {e}")
              sys.exit(1)

          canonical = 'v' + parsed.public
          if tag != canonical:
              print(f"Tag '{tag}' is valid but not canonical. Expected '{canonical}'.")
              sys.exit(1)

          print(f"Tag '{tag}' OK (PEP 440 canonical).")
          PY

  # deploy
  deploy-pypi:
    # Run only if this repository is rc
    needs: validate_tag
    if: startsWith(github.ref, 'refs/tags/v') && github.repository == 'shry-project/SHRY'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
            fetch-depth: 0

      - name: Set up Python 3.11
        uses: actions/setup-python@v3
        with:
            python-version: '3.11'

      - name: Install pypa/build
        run: |
          python -m pip install --upgrade pip
          python -m pip install setuptools setuptools_scm wheel
          python setup.py sdist bdist_wheel

      - name: Publish distribution to PyPI
        if: startsWith(github.ref, 'refs/tags/v')
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
            user: __token__
            password: ${{ secrets.PYPI_SHRY_TOKEN }}
            verbose: true