publish-cli.yml

name: Publish sonilo-cli to PyPI

on:
  workflow_dispatch:
  push:
    tags: ["sonilo-cli-v*"]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # PyPI Trusted Publishing (OIDC). No PYPI_TOKEN secret needed.
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install -e ".[dev]" -e "./sonilo-cli[dev]" build
      - run: pytest sonilo-cli
      - name: Verify tag matches pyproject version
        if: github.ref_type == 'tag'
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#sonilo-cli-v}"
          PKG_VERSION=$(python -c "import tomllib; print(tomllib.load(open('sonilo-cli/pyproject.toml','rb'))['project']['version'])")
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "Tag version ($TAG_VERSION) does not match pyproject version ($PKG_VERSION)"
            exit 1
          fi
      - run: python -m build sonilo-cli
      - name: Publish to PyPI
        # Authenticates via OIDC Trusted Publishing — a pending publisher for
        # project `sonilo-cli` (repo sonilo-python, workflow publish-cli.yml)
        # must be configured on PyPI before the first tag push. Tag refs only.
        if: github.ref_type == 'tag'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: sonilo-cli/dist
          skip-existing: true