release.yml

name: Release

# Build and publish PrintMCP to PyPI when a version tag is pushed (e.g. v0.1.0).
#
# Publishing uses PyPI Trusted Publishing (OIDC) — no API token or password is
# stored anywhere. See docs/RELEASING.md for the one-time PyPI setup and how to
# cut a release.

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  build:
    name: Build distributions
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up uv + Python
        uses: astral-sh/setup-uv@v8.1.0
        with:
          python-version: "3.12"
          enable-cache: true

      - name: Verify tag matches package version
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PKG=$(uv run python -c "import importlib.metadata as m; print(m.version('printmcp'))")
          echo "tag=$TAG  package=$PKG"
          if [ "$TAG" != "$PKG" ]; then
            echo "::error::Tag v$TAG does not match pyproject version $PKG. Bump the version or fix the tag."
            exit 1
          fi

      - name: Build sdist + wheel
        run: uv build

      - name: Validate metadata
        run: uvx twine check dist/*

      - name: Upload built distributions
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/printmcp/
    permissions:
      id-token: write   # required for Trusted Publishing (OIDC)
    steps:
      - name: Download built distributions
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1