name: Publish to PyPI

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Git tag to publish (e.g., v0.1.0)'
        required: true
        type: string

permissions:
  id-token: write  # Required for trusted publishing

jobs:
  build:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.inputs.tag || github.ref }}

      - name: Verify on a tag
        shell: bash
        run: |
          if ! git describe --exact-match --tags HEAD 2>/dev/null; then
            echo "ERROR: Not on a git tag. PyPI requires clean version numbers."
            echo "Current version would be: $(git describe --tags --always)"
            exit 1
          fi
          echo "Building from tag: $(git describe --exact-match --tags HEAD)"

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Build package
        run: uv build

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish:
    needs: build
    runs-on: ubuntu-latest
    environment: pypi

    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
