release.yml

# Copyright the Hyperledger Fabric contributors. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

name: Release

# IMPORTANT: PyPI validates against the filename (release.yml),
# the owner, and the repo registered in the Trusted Publisher. If you change
# the filename, update the registration on pypi.org.
on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
      - "v[0-9]+.[0-9]+.[0-9]+-*"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment: pypi          # Must exist in GitHub AND be registered in PyPI
    permissions:
      id-token: write          # OIDC: mandatory for Trusted Publishing
      contents: read

    steps:
      # The hashes correspond to the most recent versions at the time of this
      # analysis; update via Dependabot (see dependabot.yml).
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install build dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install build twine packaging

      - name: Build distribution
        run: python -m build --sdist --wheel

      - name: Check metadata
        run: python -m twine check dist/*

      - name: Verify tag matches package version
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          python - <<'PY'
          import glob
          import os
          import zipfile
          from packaging.version import Version

          tag = os.environ["GITHUB_REF_NAME"]
          if not tag.startswith("v"):
              raise SystemExit(f"Unexpected tag (must start with 'v'): {tag}")

          wheels = glob.glob("dist/*.whl")
          if not wheels:
              raise SystemExit("No wheel found in dist/")

          with zipfile.ZipFile(wheels[0]) as zf:
              meta = next(n for n in zf.namelist() if n.endswith(".dist-info/METADATA"))
              version = None
              for line in zf.read(meta).decode().splitlines():
                  if line.startswith("Version:"):
                      version = line.split(":", 1)[1].strip()
                      break
          if version is None:
              raise SystemExit("METADATA without version")

          print(f"Git tag:         {tag}")
          print(f"Package version: {version}")
          if Version(tag.removeprefix("v")) != Version(version):
              raise SystemExit(f"::error::Version mismatch: tag={tag}, package={version}")
          print("OK: tag and version match")
          PY

      # Trusted Publishing: no password required. The action obtains an ephemeral
      # OIDC token signed by GitHub, which PyPI validates against the
      # registered publisher. There are no secrets to rotate or leak.
      - name: Publish to PyPI
        if: startsWith(github.ref, 'refs/tags/')
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
        # attestations: true   # optional: generate PEP 740 attestations (supply chain)