release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

  # Keep manual trigger for dry runs
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Dry run — build everything but don't publish"
        required: false
        type: boolean
        default: true

permissions:
  contents: write
  packages: write

jobs:
  # ── Extract version from tag or pyproject.toml ──
  meta:
    name: Extract version
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.ver.outputs.version }}
      is_tag: ${{ steps.ver.outputs.is_tag }}
    steps:
      - uses: actions/checkout@v4

      - name: Determine version
        id: ver
        run: |
          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
            TAG_VERSION="${GITHUB_REF#refs/tags/}"
            echo "version=$TAG_VERSION" >> "$GITHUB_OUTPUT"
            echo "is_tag=true" >> "$GITHUB_OUTPUT"
          else
            PY_VERSION="v$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
            echo "version=$PY_VERSION" >> "$GITHUB_OUTPUT"
            echo "is_tag=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Verify pyproject.toml matches tag
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          PY_VERSION="v$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
          TAG_VERSION="${GITHUB_REF#refs/tags/}"
          if [ "$PY_VERSION" != "$TAG_VERSION" ]; then
            echo "::error::pyproject.toml version ($PY_VERSION) does not match tag ($TAG_VERSION)"
            exit 1
          fi

  # ── Fast Linux test job ──
  test:
    name: Test (linux-amd64)
    needs: meta
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"

      - name: Set up Python
        run: uv python install 3.13

      - name: Install dependencies
        run: uv sync --all-extras

      - name: Run tests
        run: uv run pytest tests/ -v

  # ── Build platform binaries ──
  build-binaries:
    name: Build ${{ matrix.platform }}
    needs: meta
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-14
            platform: darwin-arm64
          - runner: ubuntu-latest
            platform: linux-amd64
          - runner: ubuntu-24.04-arm
            platform: linux-arm64

    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"

      - name: Set up Python
        run: uv python install 3.13

      - name: Install dependencies
        run: uv sync --all-extras

      - name: Run tests
        run: uv run pytest tests/ -v

      - name: Build binary
        run: |
          uv run pyinstaller mithai.spec --noconfirm
          ls -lh dist/mithai-*

      - name: Smoke test binary
        shell: bash
        run: |
          BINARY=$(ls dist/mithai-*)
          chmod +x "$BINARY" 2>/dev/null || true
          "$BINARY" --version
          "$BINARY" --help
          echo "Smoke tests passed for $BINARY"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: mithai-${{ matrix.platform }}
          path: dist/mithai-*
          if-no-files-found: error

  # ── Build Python package ──
  build-python-package:
    name: Build Python package
    needs: [meta, test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          version: "latest"

      - name: Set up Python
        run: uv python install 3.13

      - name: Build wheel and sdist
        run: uv build

      - name: Validate package metadata
        run: uvx twine check dist/*

      - name: Upload Python package artifact
        uses: actions/upload-artifact@v4
        with:
          name: python-dist
          path: dist/*
          if-no-files-found: error

  # ── Build and publish container image ──
  build-container:
    name: Build container image
    needs: [meta, test]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        if: ${{ needs.meta.outputs.is_tag == 'true' && !inputs.dry_run }}
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/last9/mithai
          tags: |
            type=semver,pattern={{version}},value=${{ needs.meta.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.meta.outputs.version }}
            type=raw,value=latest,enable=${{ needs.meta.outputs.is_tag == 'true' }}

      - name: Build and optionally push image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: deploy/Dockerfile
          platforms: linux/amd64
          push: ${{ needs.meta.outputs.is_tag == 'true' && !inputs.dry_run }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ── Publish Python package ──
  publish-pypi:
    name: Publish to PyPI
    needs: [meta, build-python-package]
    if: ${{ needs.meta.outputs.is_tag == 'true' && !inputs.dry_run }}
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/mithai/
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Download Python package artifact
        uses: actions/download-artifact@v4
        with:
          name: python-dist
          path: dist/

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  # ── Create GitHub Release ──
  release:
    name: Create GitHub Release
    needs: [meta, build-binaries, build-container, publish-pypi]
    if: ${{ needs.meta.outputs.is_tag == 'true' && !inputs.dry_run }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download binary artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: mithai-*
          path: artifacts/

      - name: Prepare release assets
        run: |
          mkdir -p release/
          find artifacts/ -name 'mithai-*' -type f -exec mv {} release/ \;
          chmod +x release/mithai-* 2>/dev/null || true

          cd release
          sha256sum mithai-* > checksums.txt 2>/dev/null || shasum -a 256 mithai-* > checksums.txt
          echo "=== Release assets ==="
          ls -lh
          echo ""
          echo "=== Checksums ==="
          cat checksums.txt

      - name: Generate release notes
        id: notes
        env:
          RELEASE_VERSION: ${{ needs.meta.outputs.version }}
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")

          {
            echo "NOTES<<EOF"
            echo "## Mithai ${RELEASE_VERSION}"
            echo ""
            echo "### What's changed"
            echo ""
            if [ -n "$PREV_TAG" ]; then
              git log --pretty=format:"- %s" "${PREV_TAG}..HEAD" -- | head -30
            else
              git log --pretty=format:"- %s" -20
            fi
            echo ""
            echo ""
            echo "### Checksums (SHA256)"
            echo ""
            echo '```'
            cat release/checksums.txt
            echo '```'
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        env:
          RELEASE_VERSION: ${{ needs.meta.outputs.version }}
          RELEASE_NOTES: ${{ steps.notes.outputs.NOTES }}
          GH_TOKEN: ${{ github.token }}
        run: |
          PRERELEASE_FLAG=""
          case "$RELEASE_VERSION" in
            *-*) PRERELEASE_FLAG="--prerelease" ;;
          esac

          gh release create "$RELEASE_VERSION" \
            --title "$RELEASE_VERSION" \
            --notes "$RELEASE_NOTES" \
            $PRERELEASE_FLAG \
            release/mithai-* \
            release/checksums.txt