ci-cd.yml

name: CI/CD

on:
  push:
    tags:
      - '**'

permissions: write

jobs:

  check-tag-version-job:

    name: Check Tag Version
    runs-on: ubuntu-latest

    steps:
      - name: SCM Checkout
        uses: actions/checkout@v4

      - name: Setup Environment
        uses: ./.github/actions/env

      - name: Check Tag Version
        # make sure the pushed/created tag matched the project version
        run: "[[ `poetry version --short` == ${{ github.ref_name }} ]]"

  ci-job:
    name: Checks
    needs: [ check-tag-version-job ]
    uses: ./.github/workflows/checks.yml

  cd-job:
    name: Continues Delivery
    needs: [ ci-job ]
    runs-on: ubuntu-latest
    permissions:
      # IMPORTANT: this permission is mandatory for trusted publishing
      id-token: write

    steps:

      - name: SCM Checkout
        uses: actions/checkout@v4

      - name: Setup Environment
        uses: ./.github/actions/env

      - name: Build Artifacts
        run: just build

      - name: Publish package to PyPi
        uses: pypa/gh-action-pypi-publish@release/v1

      - name: GitHub Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: >
          gh release create ${GITHUB_REF_NAME}
          --title ${GITHUB_REF_NAME}
          --notes-file doc/changes/changes_${GITHUB_REF_NAME}.md
          dist/*