release.yml

name: Release

on:
  workflow_dispatch: {}
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

env:
  PYTHON_VERSION: "3.14"
  RUST_VERSION: "1.95.0"

jobs:
  forgejo-release-guard:
    name: Forgejo release guard
    if: github.server_url != 'https://github.com'
    runs-on: rust
    steps:
      - name: Skip publish-only release workflow
        run: echo "Release publishing runs only on GitHub; Forgejo tag CI is intentionally a no-op."

  sdist:
    name: source distribution
    if: github.server_url == 'https://github.com'
    runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'rust' }}
    steps:
      - name: Checkout solverforge-py
        uses: actions/checkout@v6
        with:
          path: solverforge-py

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_VERSION }}
          components: rustfmt, clippy

      - name: Build sdist
        working-directory: solverforge-py
        run: make build-sdist

      - name: Upload sdist
        uses: actions/upload-artifact@v7
        with:
          name: sdist
          path: solverforge-py/dist/*.tar.gz

  wheels:
    name: wheel ${{ matrix.os }} ${{ matrix.target }}
    if: github.server_url == 'https://github.com'
    runs-on: ${{ github.server_url == 'https://github.com' && matrix.os || 'rust' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64
            manylinux: "2014"
            interpreter: python3.14
          - os: macos-14
            target: aarch64
            manylinux: ""
            interpreter: python3.14
          - os: windows-latest
            target: x64
            manylinux: ""
            interpreter: python
    steps:
      - name: Checkout solverforge-py
        uses: actions/checkout@v6
        with:
          path: solverforge-py

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          command: build
          args: --release --locked --strip --compatibility pypi -i ${{ matrix.interpreter }} --out dist
          manylinux: ${{ matrix.manylinux }}
          target: ${{ matrix.target }}
          rust-toolchain: ${{ env.RUST_VERSION }}
          working-directory: solverforge-py

      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-${{ matrix.os }}-${{ matrix.target }}
          path: solverforge-py/dist/*.whl

  verify:
    name: verify artifacts
    if: github.server_url == 'https://github.com'
    runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'rust' }}
    needs: [sdist, wheels]
    steps:
      - name: Checkout solverforge-py
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifact-download

      - name: Collect distributions
        run: |
          mkdir dist
          find artifact-download -type f \( -name '*.whl' -o -name '*.tar.gz' \) -exec cp '{}' dist/ \;

      - name: Install release tools
        run: python -m pip install --disable-pip-version-check twine

      - name: Check metadata
        run: |
          python -m twine check dist/*
          python scripts/verify_release_artifacts.py --dist dist

      - name: Upload verified distributions
        uses: actions/upload-artifact@v7
        with:
          name: release-dist
          path: dist/*

  publish-testpypi:
    name: publish to TestPyPI
    runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'rust' }}
    needs: verify
    if: >-
      always() &&
      needs.verify.result == 'success' &&
      github.server_url == 'https://github.com' &&
      github.event_name == 'workflow_dispatch'
    environment: testpypi
    permissions:
      contents: read
    steps:
      - name: Download verified distributions
        uses: actions/download-artifact@v8
        with:
          name: release-dist
          path: dist

      - name: Publish to TestPyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/
          password: ${{ secrets.TEST_PYPI_API_TOKEN }}

  publish-pypi:
    name: publish to PyPI
    runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'rust' }}
    needs: verify
    if: >-
      always() &&
      needs.verify.result == 'success' &&
      github.server_url == 'https://github.com' &&
      github.event_name == 'push' &&
      startsWith(github.ref, 'refs/tags/v')
    environment: pypi
    permissions:
      contents: read
    steps:
      - name: Checkout solverforge-py
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Validate tag version
        run: |
          python - <<'PY'
          import os
          import tomllib

          with open("pyproject.toml", "rb") as handle:
              version = tomllib.load(handle)["project"]["version"]

          expected = f"v{version}"
          actual = os.environ["GITHUB_REF_NAME"]
          if actual != expected:
              raise SystemExit(f"tag {actual} does not match package version {expected}")
          PY

      - name: Download verified distributions
        uses: actions/download-artifact@v8
        with:
          name: release-dist
          path: dist

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}