releaser.yaml

name: release

on:
  push:
    tags: [ 'v[1-9]+.*' ]
  workflow_dispatch:
    inputs:
      which-pypi:
        description: 'Which Python package index?'
        required: true
        type: choice
        options:
          - pypi
          - testpypi
        default: testpypi

env:
  DISTRIBUTIONS_PATH: '.auxiliary/artifacts/hatch-build'

jobs:

  initialize:
    uses: ./.github/workflows/core--initializer.yaml

  test:
    needs: [initialize]
    uses: emcd/python-project-common/.github/workflows/xrepo--tester.yaml@gha-1
    with:
      matrix-exclusions: '${{ needs.initialize.outputs.matrix-exclusions }}'
      platforms: '${{ needs.initialize.outputs.platforms }}'
      python-descriptors: '${{ needs.initialize.outputs.python-descriptors }}'
      python-versions: '${{ needs.initialize.outputs.python-versions }}'

  report:
    needs: [initialize, test]
    uses: emcd/python-project-common/.github/workflows/xrepo--reporter.yaml@gha-1
    with:
      python-version: '${{ fromJSON(needs.initialize.outputs.python-versions)[0] }}'

  docsgen:
    needs: [initialize, report]
    permissions:
      contents: write
      id-token: write
      pages: write
    uses: emcd/python-project-common/.github/workflows/xrepo--documenter.yaml@gha-1
    with:
      include-reports: true
      python-version: '${{ fromJSON(needs.initialize.outputs.python-versions)[0] }}'

  package:
    needs: [initialize, docsgen]
    uses: emcd/python-project-common/.github/workflows/xrepo--packager.yaml@gha-1
    with:
      artifacts-path: '.auxiliary/artifacts/hatch-build' # TODO: Use environment.
      python-version: '${{ fromJSON(needs.initialize.outputs.python-versions)[0] }}'

  publish-pypi:
    if: ${{ inputs.which-pypi == 'testpypi' || startsWith(github.ref, 'refs/tags/') }}
    needs: [initialize, package]
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.which-pypi || 'pypi' }}
      url: ${{ fromJSON(needs.initialize.outputs.pypi-package-urls)[inputs.which-pypi || 'pypi'] }}mimeogram
    permissions:
      id-token: write  # Only needed for PyPI trusted publishing
    steps:

      - name: Restore Distributions
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions--${{ github.run_id }}
          path: ${{ env.DISTRIBUTIONS_PATH }}

      - name: Publish Distributions
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: ${{ env.DISTRIBUTIONS_PATH }}
          repository-url: ${{ fromJSON(needs.initialize.outputs.pypi-api-urls)[inputs.which-pypi || 'pypi'] }}
          print-hash: true
          skip-existing: ${{ inputs.which-pypi == 'testpypi' }}

  create-executables:
      needs: [initialize, package]
      strategy:
        matrix:
          include:
            - os: ubuntu-22.04 # Earlier version for better Glibc compatibility.
              platform-name: linux-x86_64
            - os: ubuntu-22.04-arm # Earlier version for better Glibc compatibility.
              platform-name: linux-aarch64
            - os: windows-latest
              platform-name: windows-x86_64
            - os: macos-15-intel
              platform-name: macos-x86_64
            - os: macos-latest
              platform-name: macos-arm64
      runs-on: ${{ matrix.os }}
      env:
        _PYI_EXECUTABLE_NAME: mimeogram-${{ github.ref_name }}-${{ matrix.platform-name }}
      steps:
        - name: Prepare Python
          uses: emcd/python-project-common/.github/actions/python-hatch@gha-1
          with:
            python-version: ${{ fromJSON(needs.initialize.outputs.python-versions)[0] }}

        # - name: Install UPX (Linux)  # Pre-installed on GHA Ubuntu runners
        #   if: ${{ runner.os == 'Linux' }}
        #   run: sudo apt-get install --yes upx

        - name: Install UPX (macOS)
          if: ${{ runner.os == 'macOS' }}
          run: brew install upx

        - name: Install UPX (Windows)
          if: ${{ runner.os == 'Windows' }}
          run: choco install upx

        - name: Create Executable
          run: |
            hatch --env develop run \
              pyinstaller \
                --clean --distpath=.auxiliary/artifacts/pyinstaller \
                pyinstaller.spec
          shell: bash

        - name: Validate Executable (simple help)
          # TODO: Validate executable on Windows.
          #       Need to find feasible way to address:
          #         https://github.com/tartley/colorama/issues/319
          if: ${{ runner.os != 'Windows' }}
          run: |
            set -eu -o pipefail
            .auxiliary/artifacts/pyinstaller/${_PYI_EXECUTABLE_NAME} --help
            .auxiliary/artifacts/pyinstaller/${_PYI_EXECUTABLE_NAME} apply --help
            .auxiliary/artifacts/pyinstaller/${_PYI_EXECUTABLE_NAME} create --help
          shell: bash

        - name: Validate Executable (commands)
          run: |
            set -eu -o pipefail
            .auxiliary/artifacts/pyinstaller/${_PYI_EXECUTABLE_NAME} \
              create --clipboard False sources/mimeogram/__init__.py >validate.mg
            .auxiliary/artifacts/pyinstaller/${_PYI_EXECUTABLE_NAME} \
              apply --clipboard False --review-mode silent <validate.mg
            rm validate.mg
          shell: bash

        - name: Save Executable
          uses: actions/upload-artifact@v4
          with:
            name: executables--${{ matrix.platform-name }}--${{ github.run_id }}
            path: .auxiliary/artifacts/pyinstaller/mimeogram-*

  publish-github:
    needs:
      - initialize
      - package
      - publish-pypi
      # --- BEGIN: Injected by Copier ---
      - create-executables
      # --- END: Injected by Copier ---
    runs-on: ubuntu-latest
    permissions:
      attestations: write
      contents: write
      id-token: write
    steps:

      - name: Prepare Python
        uses: emcd/python-project-common/.github/actions/python-hatch@gha-1
        with:
          python-version: ${{ fromJSON(needs.initialize.outputs.python-versions)[0] }}

      - name: Restore Distributions
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions--${{ github.run_id }}
          path: ${{ env.DISTRIBUTIONS_PATH }}

      - name: Restore Executables
        uses: actions/download-artifact@v4
        with:
          pattern: executables--*--${{ github.run_id }}
          path: ${{ env.DISTRIBUTIONS_PATH }}
          merge-multiple: true

      - name: Generate Integrity Check Values
        run: |
          set -eu -o pipefail
          cd ${{ env.DISTRIBUTIONS_PATH }}
          sha256sum mimeogram-* >SHA256SUMS.txt

      - name: Attest Build Provenance
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: |
            ${{ env.DISTRIBUTIONS_PATH }}/SHA256SUMS.txt
            ${{ env.DISTRIBUTIONS_PATH }}/mimeogram-*

      - name: Generate Release Notes
        run: |
          set -eu -o pipefail
          hatch --env develop run \
            towncrier build --draft --version ${GITHUB_REF_NAME} \
            >.auxiliary/artifacts/tc-release-notes.rst
          cat \
            documentation/executables.rst \
            .auxiliary/artifacts/tc-release-notes.rst \
            >.auxiliary/artifacts/release-notes.rst

      - name: Create Release
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          gh release create '${{ github.ref_name }}' \
            --repo '${{ github.repository }}' \
            --notes-file .auxiliary/artifacts/release-notes.rst

      - name: Publish Artifacts
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          gh release upload '${{ github.ref_name }}' \
            ${{ env.DISTRIBUTIONS_PATH }}/* \
            --repo '${{ github.repository }}'