release.yaml

name: Release to PyPI
on:
  push:
    tags: ["*"]
permissions:
  contents: read
env:
  dists-artifact-name: python-package-distributions
jobs:
  build:
    runs-on: ubuntu-26.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Require a versioned changelog entry
        env:
          TAG: ${{ github.ref_name }}
        run: |
          if [[ ! "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || ! grep -Fq "## $TAG (" CHANGELOG.md; then
            echo "::error::$TAG has no matching changelog entry"
            exit 1
          fi
      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          python-version: "3.15"
          enable-cache: false
          cache-dependency-glob: "pyproject.toml"
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Build package
        run: uv build --python 3.15 --python-preference only-managed --sdist --wheel . --out-dir dist
      - name: Match distributions to the tag
        env:
          TAG: ${{ github.ref_name }}
        run: |
          test -f "dist/pytest_env-${TAG}.tar.gz"
          compgen -G "dist/pytest_env-${TAG}-*.whl" >/dev/null
      - name: Store the distribution packages
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.dists-artifact-name }}
          path: dist/*
  release:
    needs:
      - build
    runs-on: ubuntu-26.04
    environment:
      name: release
      url: https://pypi.org/project/pytest-env/${{ github.ref_name }}
    permissions:
      id-token: write
    steps:
      - name: Download all the dists
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ env.dists-artifact-name }}
          path: dist/
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          attestations: true
  github-release:
    needs: release
    runs-on: ubuntu-26.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Publish GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          awk -v tag="$TAG" 'index($0, "## " tag " (") == 1 { found = 1; next } found && /^## / { exit } found { print }' CHANGELOG.md > "$RUNNER_TEMP/release-notes.md"
          test -s "$RUNNER_TEMP/release-notes.md"
          printf '\n[PyPI release](https://pypi.org/project/pytest-env/%s/)\n' "$TAG" >> "$RUNNER_TEMP/release-notes.md"
          previous=$(git tag --list '[0-9]*' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | awk -v tag="$TAG" '$0 == tag { print previous; exit } { previous = $0 }')
          if [[ -n "$previous" ]]; then
            printf '\n**Full Changelog**: https://github.com/%s/compare/%s...%s\n' "$GITHUB_REPOSITORY" "$previous" "$TAG" >> "$RUNNER_TEMP/release-notes.md"
          else
            printf '\n**Full Changelog**: https://github.com/%s/commits/%s\n' "$GITHUB_REPOSITORY" "$TAG" >> "$RUNNER_TEMP/release-notes.md"
          fi
          gh release create "$TAG" --verify-tag --title "$TAG" --notes-file "$RUNNER_TEMP/release-notes.md"