---
name: Release

on: workflow_dispatch

jobs:
  build:
    name: Publish a release
    runs-on: ubuntu-latest

    # Specifying an environment is strongly recommended by PyPI.
    # See https://github.com/pypa/gh-action-pypi-publish/tree/release/v1/?tab=readme-ov-file#trusted-publishing.
    environment: release

    permissions:
      # This is needed for PyPI publishing.
      # See https://github.com/pypa/gh-action-pypi-publish/tree/release/v1/?tab=readme-ov-file#trusted-publishing.
      id-token: write
      # This is needed for https://github.com/stefanzweifel/git-auto-commit-action.
      contents: write

    steps:
      - uses: actions/checkout@v7
        with:  # zizmor: ignore[artipacked] git-auto-commit-action requires credentials
          # See
          # https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#push-to-protected-branches
          token: ${{ secrets.RELEASE_PAT }}
          # Fetch all history including tags.
          # Needed to find the latest tag.
          #
          # Also, avoids
          # https://github.com/stefanzweifel/git-auto-commit-action/issues/99.
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: '**/pyproject.toml'

      - name: Calver calculate version
        uses: StephaneBour/actions-calver@master
        id: calver
        with:
          date_format: '%Y.%m.%d'
          release: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # towncrier writes the rendered notes to stdout (informational
      # chatter goes to stderr), so this is the curated release body for
      # this version, not github-tag-action's commit-derived changelog.
      - name: Generate the GitHub release notes
        env:
          RELEASE: ${{ steps.calver.outputs.release }}
        run: uv run --extra=release towncrier build --draft --version "$RELEASE" >
          release-notes.md

      # Assemble the same fragments into CHANGELOG.rst under a new
      # ``$RELEASE`` section and delete the consumed fragment files.
      - name: Update the changelog
        env:
          RELEASE: ${{ steps.calver.outputs.release }}
        run: uv run --extra=release towncrier build --yes --version "$RELEASE"

      - uses: stefanzweifel/git-auto-commit-action@v7
        id: commit
        with:
          commit_message: Bump CHANGELOG
          file_pattern: CHANGELOG.rst newsfragments
          # Error if there are no changes.
          skip_dirty_check: true

      - name: Bump version and push tag
        id: tag_version
        uses: mathieudutour/github-tag-action@v6.2
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          custom_tag: ${{ steps.calver.outputs.release }}
          tag_prefix: ''
          commit_sha: ${{ steps.commit.outputs.commit_hash }}

      - name: Create a GitHub release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ steps.tag_version.outputs.new_tag }}
          makeLatest: true
          name: Release ${{ steps.tag_version.outputs.new_tag }}
          bodyFile: release-notes.md

      - name: Build a binary wheel and a source tarball
        env:
          NEW_TAG: ${{ steps.tag_version.outputs.new_tag }}
        run: |
          git fetch --tags
          git checkout "$NEW_TAG"
          uv build --sdist --wheel --out-dir dist/
          uv run --extra=release check-wheel-contents dist/*.whl

      - name: Publish distribution 📦 to PyPI
        # We use PyPI trusted publishing rather than a PyPI API token.
        # See https://github.com/pypa/gh-action-pypi-publish/tree/release/v1/?tab=readme-ov-file#trusted-publishing.
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          verbose: true