AareDAQ/.gitea/workflows/publish.yml

name: Build and Publish
on:
  push:
    branches:
      - main
  workflow-dispatch:

jobs:
  release:
    runs-on: ubuntu-latest
    concurrency:
      group: ${{ github.workflow }}-release-${{ github.ref_name }}
      cancel-in-progress: false
    outputs:
      release_made: ${{ steps.release_step.outputs.release_made }}
    permissions:
      contents: write
    steps:
      - name: Setup | Checkout Repository on Release Branch
        uses: actions/checkout@v6
        with:
          ref: ${{ github.ref_name }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Setup | Force release branch to be at workflow sha
        run: |
          git reset --hard ${{ github.sha }}
      - name: Evaluate | Verify upstream has NOT changed
        shell: bash
        env:
          MX_GITEA_BOT_TOKEN: ${{ secrets.MX_GITEA_BOT_TOKEN }}
        run: |
          set +o pipefail

          UPSTREAM_BRANCH_NAME="$(git status -sb | head -n 1 | cut -d' ' -f2 | grep -E '\.{3}' | cut -d'.' -f4)"
          printf '%s\n' "Upstream branch name: $UPSTREAM_BRANCH_NAME"

          set -o pipefail

          if [ -z "$UPSTREAM_BRANCH_NAME" ]; then
              printf >&2 '%s\n' "::error::Unable to determine upstream branch name!"
              exit 1
          fi

          # checkout ran with persist-credentials: false, so the remote carries no
          # credentials; give it the bot token to reach this private repo.
          git remote set-url "${UPSTREAM_BRANCH_NAME%%/*}" \
            "https://${MX_GITEA_BOT_TOKEN}@gitea.psi.ch/${{ github.repository }}.git"

          git fetch "${UPSTREAM_BRANCH_NAME%%/*}"

          if ! UPSTREAM_SHA="$(git rev-parse "$UPSTREAM_BRANCH_NAME")"; then
              printf >&2 '%s\n' "::error::Unable to determine upstream branch sha!"
              exit 1
          fi

          HEAD_SHA="$(git rev-parse HEAD)"

          if [ "$HEAD_SHA" != "$UPSTREAM_SHA" ]; then
              printf >&2 '%s\n' "[HEAD SHA] $HEAD_SHA != $UPSTREAM_SHA [UPSTREAM SHA]"
              printf >&2 '%s\n' "::error::Upstream has changed, aborting release..."
              exit 1
          fi

          printf '%s\n' "Verified upstream branch has not changed, continuing with release..."

      - name: Semantic Version Release
        id: release_step
        env:
          TWINE_USERNAME: "__token__"
          TWINE_PASSWORD: ${{ secrets.MX_GITEA_BOT_TOKEN }}
          MX_GITEA_BOT_TOKEN: ${{ secrets.MX_GITEA_BOT_TOKEN }}
        run: |
          pip install python-semantic-release==9.* wheel build twine
          semantic-release --config ./ci/semantic_release.toml version
          if [ ! -d dist ]; then echo No release will be made; echo "release_made=false" >> "$GITHUB_OUTPUT"; exit 0; fi
          echo "release_made=true" >> "$GITHUB_OUTPUT"
          twine upload dist/* --repository-url https://gitea.psi.ch/api/packages/mx/pypi
          semantic-release publish