release.yaml

name: release

# https://peps.python.org/pep-0440/ : [N!]N(.N)*[{a|b|rc}N][.postN][.devN]
on:
  push:
    tags:
      - "[0-9]+.[0-9]+.[0-9]+"
      - "[0-9]+.[0-9]+.[0-9]+a[0-9]+"
      - "[0-9]+.[0-9]+.[0-9]+b[0-9]+"
      - "[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
      - "[0-9]+.[0-9]+.[0-9]+.dev[0-9]+"

env:
  PACKAGE_NAME: "rsna-anonymizer"
  OWNER: "RSNA"

jobs:
  details:
    runs-on: ubuntu-latest
    outputs:
      new_version: ${{ steps.release.outputs.new_version }}
      suffix: ${{ steps.release.outputs.suffix }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - uses: actions/checkout@v4

      - name: Extract tag and Details
        id: release
        run: |
          if [ "${{ github.ref_type }}" = "tag" ]; then
            TAG_NAME=${GITHUB_REF#refs/tags/}
            TAG_NAME=${TAG_NAME#v}
            NEW_VERSION=$TAG_NAME
            SUFFIX=$(echo "$TAG_NAME" | grep -oE '(a|b|rc|\.dev)[0-9]+' | tail -n 1 || echo "")
            echo "new_version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
            echo "suffix=$SUFFIX" >> "$GITHUB_OUTPUT"
            echo "tag_name=$TAG_NAME" >> "$GITHUB_OUTPUT"
            echo "Version is $NEW_VERSION"
            echo "Suffix is $SUFFIX"
            echo "Tag name is $TAG_NAME"
          else
            echo "No tag found"
            exit 1
          fi

  check_pypi:
    needs: details
    runs-on: ubuntu-latest
    outputs:
      already_on_pypi: ${{ steps.check.outputs.already_on_pypi }}
    steps:
      - name: Validate PyPI version availability
        id: check
        env:
          NEW_VERSION: ${{ needs.details.outputs.new_version }}
        run: |
          response=$(curl -s "https://pypi.org/pypi/${{ env.PACKAGE_NAME }}/json" || echo "{}")
          if echo "$response" | jq -e --arg v "$NEW_VERSION" '.releases[$v] != null' >/dev/null; then
            echo "Version $NEW_VERSION is already published on PyPI; skipping PyPI upload."
            echo "already_on_pypi=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "already_on_pypi=false" >> "$GITHUB_OUTPUT"

          if echo "$NEW_VERSION" | grep -qE '(a|b|rc|\.dev)[0-9]+$'; then
            echo "Pre-release $NEW_VERSION is not yet on PyPI; continuing."
            exit 0
          fi

          latest_stable=$(echo "$response" | jq -r '
            [.releases | keys[] | select(test("(a|b|rc|\\.dev)[0-9]+$") | not)]
            | sort_by(.) | last // "0.0.0"
          ')
          echo "Latest stable on PyPI: $latest_stable"
          if [ "$(printf '%s\n' "$latest_stable" "$NEW_VERSION" | sort -rV | head -n 1)" != "$NEW_VERSION" ] || [ "$NEW_VERSION" = "$latest_stable" ]; then
            echo "Stable version $NEW_VERSION is not newer than latest stable $latest_stable on PyPI."
            exit 1
          fi
          echo "Stable version $NEW_VERSION is newer than $latest_stable on PyPI."

  setup_and_build:
    needs: [details, check_pypi]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Detect build backend
        id: backend
        run: |
          if grep -q '^\[tool\.poetry\]' pyproject.toml; then
            echo "backend=poetry" >> "$GITHUB_OUTPUT"
          else
            echo "backend=hatch" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Build with Poetry (master / V18)
        if: steps.backend.outputs.backend == 'poetry'
        run: |
          curl -sSL https://install.python-poetry.org | python3 -
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          poetry version "${{ needs.details.outputs.new_version }}"
          poetry install --no-interaction
          poetry build

      - name: Install uv
        if: steps.backend.outputs.backend == 'hatch'
        uses: astral-sh/setup-uv@v5

      - name: Build with uv (V19+)
        if: steps.backend.outputs.backend == 'hatch'
        env:
          NEW_VERSION: ${{ needs.details.outputs.new_version }}
        run: |
          pyproject_version=$(python - <<'PY'
          import tomllib
          from pathlib import Path
          data = tomllib.loads(Path("pyproject.toml").read_text())
          print(data["project"]["version"])
          PY
          )
          if [ "$pyproject_version" != "$NEW_VERSION" ]; then
            echo "pyproject.toml version ($pyproject_version) must match tag ($NEW_VERSION) for hatch builds."
            exit 1
          fi
          uv build

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  pypi_publish:
    name: Upload release to PyPI
    needs: [setup_and_build, details, check_pypi]
    if: needs.check_pypi.outputs.already_on_pypi != 'true'
    runs-on: ubuntu-latest
    environment:
      name: release
    permissions:
      id-token: write
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish distribution to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  github_release:
    name: Create GitHub Release
    needs: [setup_and_build, details]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ needs.details.outputs.tag_name }}
        run: |
          if gh release view "$TAG_NAME" >/dev/null 2>&1; then
            echo "Release $TAG_NAME already exists; uploading/replacing dist assets."
            gh release upload "$TAG_NAME" dist/* --clobber
          else
            gh release create "$TAG_NAME" dist/* \
              --title "$TAG_NAME" \
              --generate-notes
          fi