release.yml

name: Publish PyPI package

on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  publish:
    if: ${{ !github.event.release.prerelease }}
    runs-on: ubuntu-22.04
    timeout-minutes: 15
    environment:
      name: pypi
      url: https://pypi.org/p/grid-sdk
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.event.release.tag_name }}
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
          cache: pip
      - name: Verify release identity
        shell: bash
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          set -euo pipefail
          version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
          module_version="$(python - <<'PY'
          import ast
          from pathlib import Path

          tree = ast.parse(Path("src/grid_sdk/__init__.py").read_text())
          for node in tree.body:
              if not isinstance(node, ast.Assign):
                  continue
              if any(isinstance(target, ast.Name) and target.id == "__version__" for target in node.targets):
                  print(ast.literal_eval(node.value))
                  break
          else:
              raise SystemExit("__version__ assignment not found")
          PY
          )"
          test "$module_version" = "$version" || {
            echo "module version $module_version does not match project version $version" >&2
            exit 1
          }
          test "$RELEASE_TAG" = "v$version" || {
            echo "release tag $RELEASE_TAG does not match package version $version" >&2
            exit 1
          }
          test "$(git rev-parse HEAD)" = "$(git rev-list -n 1 "$RELEASE_TAG")"
      - name: Build and inspect distributions
        run: |
          python -m pip install build==1.6.0 twine==7.0.0
          python -m build
          python -m twine check dist/*
      - name: Test built wheel
        shell: bash
        run: |
          wheel="$(find dist -maxdepth 1 -name '*.whl' -print -quit)"
          test -n "$wheel"
          python -m pip install "$wheel"
          python -c 'import grid_sdk; print(grid_sdk.__version__)'
          python -m pip install pytest pytest-asyncio respx
          pytest tests/ -v
      - name: Publish with PyPI trusted publishing
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2