publish.yml

name: publish

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

jobs:
  test:
    name: Run tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
    # 2026-07-08: parallel matrix kept (PyPI publish is a one-shot
    # event and the runner is already paid for) but pip cache
    # brought in for parity with ci.yml.
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12"]

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: "pip"
          cache-dependency-path: pyproject.toml

      - name: Install dependencies
        run: pip install -e ".[dev]" "pytest-xdist>=3.6"

      - name: Run tests
        run: pytest tests/ -v -n auto

  publish:
    name: Build and publish
    needs: test
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/nullrun
    permissions:
      id-token: write
      # contents: write is required by softprops/action-gh-release to
      # create the GitHub Release (push the tag ref + draft release).
      # The existing publish step only needs id-token for PyPI Trusted
      # Publishing, so this is additive and scoped to the new step.
      contents: write

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Build
        run: |
          pip install --upgrade build
          python -m build

      - name: Check dist
        run: |
          pip install twine
          twine check dist/*

      - name: Publish to PyPI (Trusted Publishing)
        uses: pypa/gh-action-pypi-publish@release/v1

      # GitHub Release creation — gated on tag pushes so the manual
      # workflow_dispatch path (used for hotfix re-runs) doesn't create
      # a duplicate release on the current HEAD's branch ref. The
      # ``generate_release_notes`` flag asks GitHub to auto-aggregate
      # merged PR titles + labels into the release body, which keeps
      # the GitHub release page in sync with the CHANGELOG.md body
      # without manual editing. Attached files mirror what PyPI receives
      # (wheel + sdist) so the release page doubles as a download mirror
      # for environments where pip isn't available.
      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          generate_release_notes: true
          files: |
            dist/*.whl
            dist/*.tar.gz