publish.yml

name: Publish to PyPI

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  # Reuse the full lint + test workflow so a release never ships from a
  # broken tree, even if the tag was pushed without a CI run on the commit.
  test:
    uses: ./.github/workflows/tests.yml

  # Build sdist and wheel once and hand them to the publish job as an
  # artifact, so what gets uploaded to PyPI is exactly what was built here.
  # Also fails fast if the git tag disagrees with _version.py.
  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Verify tag matches package version
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          tag_version="${GITHUB_REF_NAME#v}"
          pkg_version="$(python -c 'import re; print(re.search(r"__version__\s*=\s*\"([^\"]+)\"", open("captcha_solver_api/_version.py").read()).group(1))')"
          if [ "$tag_version" != "$pkg_version" ]; then
            echo "::error::Tag v$tag_version does not match captcha_solver_api/_version.py version $pkg_version"
            exit 1
          fi

      - name: Install build tooling
        run: python -m pip install build

      - name: Build sdist and wheel
        run: python -m build --sdist --wheel

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  # Upload the built artifacts to PyPI via trusted publishing, then create
  # the matching GitHub Release with auto-generated notes and the same
  # sdist/wheel attached. Only runs on an actual version tag --
  # workflow_dispatch runs stop at the build/test stage so you can dry-run
  # the release without shipping it.
  publish:
    needs: build
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/captcha-solver-api/
    permissions:
      # Required for PyPI's trusted publishing (OIDC) -- no API token/secret needed.
      # Configure this repo as a trusted publisher at https://pypi.org/manage/project/captcha-solver-api/settings/publishing/
      id-token: write
      # Required to create the GitHub Release.
      contents: write
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: dist/*
          # Requires Discussions enabled in the repo with this category present.
          discussion_category_name: Announcements

  changelog:
    needs: publish
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0
      - name: Generate changelog
        run: python .github/scripts/generate_changelog.py --tag "$GITHUB_REF_NAME" --repository "$GITHUB_REPOSITORY"
      - name: Commit changelog
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add CHANGELOG.md
          git diff --cached --quiet || git commit -m "docs: update changelog for $GITHUB_REF_NAME"
          git push origin main
      - name: Use changelog as release notes
        run: gh release edit "$GITHUB_REF_NAME" --notes-file release-notes.md
        env:
          GH_TOKEN: ${{ github.token }}