name: Publish to PyPI

on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/TableSleuth
    permissions:
      id-token: write  # Required for trusted publishing

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.13'

    - name: Set up Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20'
        cache: 'npm'
        cache-dependency-path: web-ui/package-lock.json

    - name: Install uv
      run: pip install uv

    - name: Install Node.js dependencies
      run: cd web-ui && npm ci

    - name: Build frontend
      run: cd web-ui && npm run build

    - name: Bundle frontend into package
      run: |
        rm -rf src/tablesleuth/web
        cp -r web-ui/out src/tablesleuth/web

    - name: Build package
      run: uv build

    - name: Verify version matches tag
      run: |
        TAG_VERSION=${GITHUB_REF#refs/tags/v}
        PKG_VERSION=$(grep '^version = ' pyproject.toml | cut -d'"' -f2)
        if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
          echo "Tag version ($TAG_VERSION) does not match package version ($PKG_VERSION)"
          exit 1
        fi

    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1
