release.yml

name: Release to PyPI

on:
  release:
    types: [published]
  workflow_dispatch:  # Allows manual triggering

jobs:
  build_wheels:
    name: Build wheels on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [windows-latest, macos-latest]
    
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive  # In case you have git submodules
    
    - name: Build wheels
      uses: pypa/cibuildwheel@v2.16.5
      env:
        # Build for Python 3.12, 3.13, 3.14
        CIBW_BUILD: "cp312-* cp313-* cp314-*"
        # Skip 32-bit builds and musl on Linux
        CIBW_SKIP: "*-win32"
        # Platform-specific settings
        CIBW_ARCHS_MACOS: "arm64"
        CIBW_ARCHS_WINDOWS: "AMD64"
    
    - name: Upload wheels
      uses: actions/upload-artifact@v4
      with:
        name: wheels-${{ matrix.os }}
        path: ./wheelhouse/*.whl

  build_sdist:
    name: Build source distribution
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: "3.12"
    
    - name: Verify version matches tag
      if: github.event_name == 'release'
      run: |
        # Extract version from pyproject.toml
        PYPROJECT_VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
        
        # Extract version from release tag (remove 'v' prefix if present)
        TAG_VERSION=${GITHUB_REF#refs/tags/}
        TAG_VERSION=${TAG_VERSION#v}
        
        echo "pyproject.toml version: $PYPROJECT_VERSION"
        echo "Tag version: $TAG_VERSION"
        
        # Check versions match
        if [ "$PYPROJECT_VERSION" != "$TAG_VERSION" ]; then
          echo "Error: Version mismatch!"
          echo "pyproject.toml version ($PYPROJECT_VERSION) does not match tag ($TAG_VERSION)"
          exit 1
        fi
        
        echo "Version check passed!"
    
    - name: Install build dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build
    
    - name: Build source distribution
      run: python -m build --sdist
    
    - name: Upload sdist
      uses: actions/upload-artifact@v4
      with:
        name: sdist
        path: dist/*.tar.gz

  publish:
    name: Publish to PyPI
    needs: [build_wheels, build_sdist]
    runs-on: ubuntu-latest
    environment: pypi_release
    permissions:
      id-token: write  # For trusted publishing
    
    steps:
    - name: Download all artifacts
      uses: actions/download-artifact@v4
      with:
        path: dist
        merge-multiple: true
    
    - name: List distributions
      run: ls -lh dist/
    
    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        password: ${{ secrets.PYPI_TOKEN }}