release-python.yml

name: Release Python SDK

on:
  push:
    branches: [main]
    paths:
      - "crates/pap-python/**"
      - "crates/pap-core/**"
      - "crates/pap-did/**"
      - "crates/pap-credential/**"
      - "crates/pap-marketplace/**"
      - "crates/pap-transport/**"
      - "Cargo.toml"
      - "Cargo.lock"
      - "VERSION"
  workflow_dispatch: {}

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  PACKAGE_NAME: pap-protocol

jobs:
  # ── 1. Detect new version and create tag ──────────────────────────────────
  check-version:
    name: Check version
    runs-on: ubuntu-latest
    outputs:
      should_release: ${{ steps.check.outputs.should_release }}
      version: ${{ steps.check.outputs.version }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Read VERSION and check for existing tag
        id: check
        run: |
          VERSION=$(cat VERSION)
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          TAG="python-v${VERSION}"
          if git rev-parse "refs/tags/${TAG}" >/dev/null 2>&1; then
            echo "Tag ${TAG} already exists — skipping release"
            echo "should_release=false" >> "$GITHUB_OUTPUT"
          else
            echo "New version ${VERSION} detected — will tag and release"
            echo "should_release=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Create and push tag
        if: steps.check.outputs.should_release == 'true'
        run: |
          git tag "python-v${{ steps.check.outputs.version }}"
          git push origin "python-v${{ steps.check.outputs.version }}"

  # ── 2. Build wheels ────────────────────────────────────────────────────────
  build-wheels:
    name: Build wheels (${{ matrix.artifact }})
    needs: check-version
    if: needs.check-version.outputs.should_release == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64
            manylinux: "2_28"
            artifact: wheels-linux-x86_64
          - os: ubuntu-latest
            target: x86_64
            manylinux: musllinux_1_2
            artifact: wheels-linux-x86_64-musl
          - os: ubuntu-latest
            target: aarch64
            manylinux: "2_28"
            artifact: wheels-linux-aarch64
          - os: macos-latest
            target: universal2-apple-darwin
            artifact: wheels-macos-universal2
          - os: windows-latest
            target: x64
            artifact: wheels-windows-x86_64

    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6

      - name: Set up QEMU (Linux aarch64 cross-compile)
        if: matrix.target == 'aarch64'
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          manylinux: ${{ matrix.manylinux || 'auto' }}
          args: >-
            --release
            --out dist
            --manifest-path crates/pap-python/Cargo.toml

      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.artifact }}
          path: dist/*.whl
          retention-days: 5

  # ── 3. Build source distribution ───────────────────────────────────────────
  build-sdist:
    name: Build sdist
    needs: check-version
    if: needs.check-version.outputs.should_release == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: >-
            --out dist
            --manifest-path crates/pap-python/Cargo.toml

      - name: Upload sdist
        uses: actions/upload-artifact@v7
        with:
          name: sdist
          path: dist/*.tar.gz
          retention-days: 5

  # ── 4. Create GitHub Release ───────────────────────────────────────────────
  create-release:
    name: GitHub Release
    needs: [check-version, build-wheels, build-sdist]
    if: needs.check-version.outputs.should_release == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: dist/
          merge-multiple: true

      - name: List artifacts
        run: ls -lh dist/

      - name: Extract changelog for this version
        id: changelog
        run: |
          VERSION="${{ needs.check-version.outputs.version }}"
          NOTES=$(awk "/^## \\[${VERSION}\\]/{found=1; next} /^## \\[/{if(found) exit} found{print}" crates/pap-python/CHANGELOG.md)
          echo "${NOTES}" > /tmp/release-notes.md

      - name: Create release
        uses: actions/github-script@v9
        env:
          VERSION: ${{ needs.check-version.outputs.version }}
        with:
          script: |
            const fs = require('fs');
            const notes = fs.readFileSync('/tmp/release-notes.md', 'utf8').trim();
            await github.rest.repos.createRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              tag_name: `python-v${process.env.VERSION}`,
              name: `Python SDK v${process.env.VERSION}`,
              body: notes || `See [CHANGELOG](https://github.com/${context.repo.owner}/${context.repo.repo}/blob/main/crates/pap-python/CHANGELOG.md) for details.`,
              draft: false,
              prerelease: false
            });

      - name: Upload release assets
        run: |
          for file in dist/*; do
            gh release upload "python-v${{ needs.check-version.outputs.version }}" "$file" --clobber
          done
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # ── 5. Publish to PyPI ─────────────────────────────────────────────────────
  publish-pypi:
    name: Publish to PyPI
    needs: [check-version, build-wheels, build-sdist]
    if: needs.check-version.outputs.should_release == 'true'
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/pap-protocol/${{ needs.check-version.outputs.version }}/
    permissions:
      id-token: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: dist/
          merge-multiple: true

      - name: List artifacts for publishing
        run: ls -lh dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/
          attestations: true