name: release

# Push a tag like v0.2.10 → wheel is built and published to PyPI via
# Trusted Publishing (no API token in repo secrets). One-time setup:
#   1. https://pypi.org/manage/project/abs-mcp/settings/publishing/
#   2. Add a "pending publisher":
#        owner = Bigred97
#        repo  = abs-mcp
#        workflow = release.yml
#        environment = pypi
#   3. Create a `pypi` environment in repo Settings → Environments
#      (no secrets needed; the environment scopes the OIDC token).
# Then any `git push origin vX.Y.Z` triggers this job.

on:
  push:
    tags:
      - "v*"

jobs:
  release:
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/abs-mcp/
    permissions:
      id-token: write     # required for Trusted Publishing OIDC
      contents: read
    steps:
      - uses: actions/checkout@v5

      - name: Install uv
        uses: astral-sh/setup-uv@v7

      - name: Sanity-check the tag matches pyproject.toml
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PYPROJECT_VERSION=$(uv run python -c "import tomllib,sys; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
          if [ "$TAG_VERSION" != "$PYPROJECT_VERSION" ]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match pyproject version $PYPROJECT_VERSION"
            exit 1
          fi
          echo "Releasing version $PYPROJECT_VERSION"

      - name: Build wheel + sdist
        run: uv build

      - name: Publish to PyPI (Trusted Publishing)
        uses: pypa/gh-action-pypi-publish@release/v1

      - uses: actions/upload-artifact@v5
        with:
          name: dist
          path: dist/
