release.yml

name: release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read
  actions: read

jobs:
  build-dist:
    name: Build and verify distributions
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6.0.2
        with:
          persist-credentials: false
      - uses: astral-sh/setup-uv@v8.0.0
        with:
          enable-cache: false
      - name: Verify tag matches project version
        if: startsWith(github.ref, 'refs/tags/v')
        shell: bash
        run: |
          project_version="$(python3 -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
          tag_version="${GITHUB_REF_NAME#v}"
          test "$tag_version" = "$project_version" || {
            echo "Tag v$tag_version does not match pyproject.toml version $project_version" >&2
            exit 1
          }
      - name: Verify CI passed for tagged commit
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          successful_runs="$(gh api \
            "/repos/${GITHUB_REPOSITORY}/actions/workflows/ci.yml/runs?head_sha=${GITHUB_SHA}&status=completed&per_page=100" \
            --jq '[.workflow_runs[] | select(.conclusion == "success")] | length')"
          test "$successful_runs" -gt 0 || {
            echo "No successful ci.yml run found for tagged commit $GITHUB_SHA" >&2
            echo "ci.yml only runs on pull_request and workflow_dispatch; dispatch it on the commit to release, then tag." >&2
            exit 1
          }
      - name: Build source distribution and wheel
        run: uv build --out-dir dist
      - name: Check distribution metadata
        run: uvx --from twine twine check dist/*
      - name: Verify RL payload files are in the wheel
        shell: bash
        run: |
          python3 - <<'EOF'
          import glob, zipfile
          whl = glob.glob('dist/*.whl')[0]
          names = set(zipfile.ZipFile(whl).namelist())
          for entry in (
              'unilab/rl/py.typed',
              'unilab/rl/runtime/ipc/replay_pipelines/native_h2d_ext.cpp',
          ):
              assert entry in names, f'{entry} missing from {whl}'
          print('wheel RL payload ok')
          EOF
      - name: Install the freshly built wheel
        run: |
          uv venv .release-venv
          uv pip install --python .release-venv/bin/python --reinstall --no-deps \
            --no-binary unilab --no-cache --find-links dist --no-index unilab
      - name: Smoke test installed wheel
        shell: bash
        run: |
          tag_version=""
          case "$GITHUB_REF" in
            refs/tags/v*) tag_version="${GITHUB_REF_NAME#v}" ;;
          esac
          .release-venv/bin/python -c "
          import unilab
          import unilab.rl.runtime.distributed.context
          assert unilab.ROOT_PATH.is_dir()
          assert (unilab.ROOT_PATH / 'conf').is_dir()
          version = unilab.__version__
          assert version != '0.0.0', version
          ref = '$tag_version'
          if ref:
              assert version == ref, f'{version} != {ref}'
          print('installed unilab', version)
          "
      - uses: actions/upload-artifact@v4.6.2
        with:
          name: release-dist
          path: dist/*

  publish:
    needs: build-dist
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    environment: pypi
    steps:
      - uses: actions/download-artifact@v4.3.0
        with:
          name: release-dist
          path: dist
      - name: Publish distributions to PyPI with trusted publishing
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist
          skip-existing: true

  github-release:
    name: Create GitHub Release
    needs: publish
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6.0.2
        with:
          persist-credentials: false
      - uses: actions/download-artifact@v4.3.0
        with:
          name: release-dist
          path: dist
      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: >-
          gh release create "$GITHUB_REF_NAME" dist/*
          --title "unilab ${GITHUB_REF_NAME#v}"
          --generate-notes