name: Release and PyPI Publish

# IMPORTANT: This repo must use squash merges only. Non-squash merges can
# orphan semantic-release's "chore: release" commit, breaking version detection.
# Enforced via GitHub repo settings (allow_merge_commit=false, allow_rebase_merge=false).

on:
  push:
    branches:
      - main

jobs:
  release:
    runs-on: ubuntu-latest
    concurrency: release
    permissions:
      id-token: write
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.ADMIN_TOKEN }}

      - name: Check if should skip
        id: check_skip
        run: |
          if [ "$(git log -1 --pretty=format:'%an')" = "semantic-release" ]; then
            echo "skip=true" >> $GITHUB_OUTPUT
          fi

      - name: Set up Python
        if: steps.check_skip.outputs.skip != 'true'
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install uv
        if: steps.check_skip.outputs.skip != 'true'
        uses: astral-sh/setup-uv@v4

      - name: Python Semantic Release
        if: steps.check_skip.outputs.skip != 'true'
        id: release
        uses: python-semantic-release/python-semantic-release@v9.15.2
        with:
          github_token: ${{ secrets.ADMIN_TOKEN }}

      - name: Build package
        if: steps.check_skip.outputs.skip != 'true' && steps.release.outputs.released == 'true'
        run: uv build

      - name: Publish to PyPI
        if: steps.check_skip.outputs.skip != 'true' && steps.release.outputs.released == 'true'
        uses: pypa/gh-action-pypi-publish@release/v1

      - name: Publish to GitHub Releases
        if: steps.check_skip.outputs.skip != 'true' && steps.release.outputs.released == 'true'
        uses: python-semantic-release/publish-action@v9.15.2
        with:
          github_token: ${{ secrets.ADMIN_TOKEN }}
