name: CI / Publish

on:
  push:
    branches: [main]
    tags: ["v*.*.*"]
  pull_request:
    branches: [main]

jobs:
  # -----------------------------------------------------------------------
  # Lint + type check + tests
  # -----------------------------------------------------------------------
  quality:
    name: Lint & Test (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dev dependencies
        run: |
          pip install -e ".[dev,encryption]"

      - name: Ruff lint
        run: ruff check pyairtel tests

      - name: Black format check
        run: black --check pyairtel tests

      - name: Mypy type check
        run: mypy pyairtel

      - name: Run tests
        run: pytest --tb=short -v

  # -----------------------------------------------------------------------
  # Build & publish to PyPI (only on version tags)
  # -----------------------------------------------------------------------
  publish:
    name: Publish to PyPI
    needs: quality
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    environment: pypi

    permissions:
      id-token: write   # required for trusted publishing (OIDC)

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install build tools
        run: pip install build

      - name: Build distribution
        run: python -m build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
