release.yml

# PyPI trusted publishing is bound to this file name. Do not rename it.
name: Release

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      tag:
        description: Existing release tag to build and publish again, for example v1.7.1
        required: true
        type: string

permissions: {}

jobs:
  release-pr:
    name: Open or update the release PR
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    concurrency:
      group: ${{ github.workflow }}-release-pr
      cancel-in-progress: false
    permissions:
      actions: write
      contents: write
      pull-requests: write
    steps:
      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json
          skip-github-release: true

      # A PR that GITHUB_TOKEN opens starts no workflows, so start CI on each
      # open release PR here. Its results show on the release PR.
      - name: Run CI on the release PR
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          gh pr list --repo "$GITHUB_REPOSITORY" --state open --author app/github-actions \
            --label "autorelease: pending" --json headRefName --jq '.[].headRefName' |
            while read -r branch; do
              echo "Starting CI on $branch"
              gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
            done

  detect:
    name: Detect a release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      release: ${{ steps.detect.outputs.release }}
      version: ${{ steps.detect.outputs.version }}
      tag: ${{ steps.detect.outputs.tag }}
      previous_tag: ${{ steps.detect.outputs.previous_tag }}
      ref: ${{ steps.detect.outputs.ref }}
      sha: ${{ steps.detect.outputs.sha }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - id: detect
        env:
          GH_TOKEN: ${{ github.token }}
          BEFORE: ${{ github.event.before }}
          INPUT_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          manifest=.release-please-manifest.json
          no_release() { echo "release=false" >>"$GITHUB_OUTPUT"; echo "No release: $1"; exit 0; }

          if [ "$GITHUB_EVENT_NAME" = workflow_dispatch ]; then
            if ! [[ "$INPUT_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "::error::The tag must look like v1.2.3."; exit 1
            fi
            git rev-parse -q --verify "refs/tags/$INPUT_TAG" >/dev/null || {
              echo "::error::The tag $INPUT_TAG does not exist."; exit 1; }
            # Only a tag this workflow released: its commit is on main and it
            # has a GitHub release. A hand-made tag on an unreviewed commit is refused.
            [ "$GITHUB_REF" = refs/heads/main ] || {
              echo "::error::Run the Release workflow from main."; exit 1; }
            git merge-base --is-ancestor "refs/tags/$INPUT_TAG" HEAD || {
              echo "::error::The tag $INPUT_TAG is not on main."; exit 1; }
            gh release view "$INPUT_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1 || {
              echo "::error::The tag $INPUT_TAG has no GitHub release."; exit 1; }
            {
              echo "release=true"
              echo "version=${INPUT_TAG#v}"
              echo "tag=$INPUT_TAG"
              echo "ref=refs/tags/$INPUT_TAG"
              echo "sha=$(git rev-list -n 1 "refs/tags/$INPUT_TAG")"
            } >>"$GITHUB_OUTPUT"
            exit 0
          fi

          # This push must merge a release PR that release-please opened and
          # change the manifest. Branch name alone is not enough: anyone with
          # write access can name a branch. "tagged" keeps a full re-run working.
          pr=$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls" --jq '
            [.[] | select(.merged_at != null
                          and (.head.ref | startswith("release-please--branches--main"))
                          and .user.login == "github-actions[bot]"
                          and ([.labels[].name] | any(. == "autorelease: pending" or . == "autorelease: tagged")))][0].number // empty')
          [ -n "$pr" ] || no_release "this push does not merge a release PR"
          if git diff --quiet "$BEFORE" "$GITHUB_SHA" -- "$manifest"; then no_release "the manifest did not change"; fi

          version=$(jq -r '."."' "$manifest")
          previous=$(git show "$BEFORE:$manifest" | jq -r '."."')
          echo "Release PR #$pr: v$previous -> v$version"
          {
            echo "release=true"
            echo "version=$version"
            echo "tag=v$version"
            echo "previous_tag=v$previous"
            echo "ref=$GITHUB_SHA"
            echo "sha=$GITHUB_SHA"
          } >>"$GITHUB_OUTPUT"

  # Checks and build run with read-only rights. The job that can mint a PyPI
  # token runs no project code.
  build:
    name: Check and build
    needs: detect
    if: needs.detect.outputs.release == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      VERSION: ${{ needs.detect.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.detect.outputs.ref }}
          persist-credentials: false

      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          version: "0.13.1"
          enable-cache: false

      - name: Run the checks
        if: github.event_name == 'push'
        run: |
          set -euo pipefail
          uv sync --all-extras --locked
          make check
          make generate
          git diff --exit-code -I '^#   timestamp:' -- src/zenrows/batch/models.py
          make test

      - name: Build
        run: |
          set -euo pipefail
          uv build
          # The built version must be the release version.
          test -f "dist/zenrows-$VERSION.tar.gz"

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  release:
    name: Tag, release and publish
    needs: [detect, build]
    runs-on: ubuntu-latest
    # The release environment deploys only from main.
    environment: release
    concurrency:
      group: ${{ github.workflow }}-release
      cancel-in-progress: false
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    env:
      VERSION: ${{ needs.detect.outputs.version }}
      TAG: ${{ needs.detect.outputs.tag }}
      PREVIOUS_TAG: ${{ needs.detect.outputs.previous_tag }}
      COMMIT: ${{ needs.detect.outputs.sha }}
      IS_PUSH: ${{ github.event_name == 'push' }}
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: dist
          path: dist/

      # A re-run after a partial release finds its own tag and goes on to publish.
      - name: Check the tag
        id: tag
        if: env.IS_PUSH == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          ref=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" 2>/dev/null) || exit 0
          sha=$(jq -r .object.sha <<<"$ref")
          if [ "$(jq -r .object.type <<<"$ref")" = tag ]; then
            sha=$(gh api "repos/$GITHUB_REPOSITORY/git/tags/$sha" --jq .object.sha)
          fi
          if [ "$sha" != "$COMMIT" ]; then
            echo "::error::The tag $TAG already exists on another commit ($sha)."
            exit 1
          fi
          echo "::notice::The tag $TAG already exists on this commit. Creating it is skipped."
          echo "exists=true" >>"$GITHUB_OUTPUT"

      - name: Check PyPI
        id: pypi
        run: |
          status=$(curl -s -o /dev/null -w '%{http_code}' "https://pypi.org/pypi/zenrows/$VERSION/json")
          if [ "$status" = 200 ]; then
            echo "::notice::zenrows $VERSION is already on PyPI. Publishing is skipped."
            echo "published=true" >>"$GITHUB_OUTPUT"
          fi

      - name: Create the tag and GitHub release
        if: env.IS_PUSH == 'true' && steps.tag.outputs.exists != 'true'
        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json
          skip-github-pull-request: true

      - name: Set the release title and notes
        if: env.IS_PUSH == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          gh api "repos/$GITHUB_REPOSITORY/releases/generate-notes" \
            -f "tag_name=$TAG" -f "previous_tag_name=$PREVIOUS_TAG" --jq .body |
            gh release edit "$TAG" --repo "$GITHUB_REPOSITORY" --title "$TAG" --notes-file -

      - name: Publish to PyPI
        if: steps.pypi.outputs.published != 'true'
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

      - name: Verify on PyPI
        run: |
          for _ in $(seq 10); do
            status=$(curl -s -o /dev/null -w '%{http_code}' "https://pypi.org/pypi/zenrows/$VERSION/json")
            [ "$status" = 200 ] && exit 0
            sleep 15
          done
          echo "::error::zenrows $VERSION is not on PyPI after 150 seconds."
          exit 1

      - name: Write the summary
        run: |
          repo="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"
          {
            echo "## zenrows $VERSION"
            echo "- Tag: [$TAG]($repo/tree/$TAG)"
            echo "- Release: [$TAG]($repo/releases/tag/$TAG)"
            echo "- PyPI: [zenrows $VERSION](https://pypi.org/project/zenrows/$VERSION/)"
            echo "- Commit: [${COMMIT:0:7}]($repo/commit/$COMMIT)"
          } >>"$GITHUB_STEP_SUMMARY"