name: Release

on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  pypi-publish:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    environment: pypi
    
    permissions:
      id-token: write  # Required for trusted publishing
    
    steps:
    - uses: actions/checkout@v5
    
    - name: Install uv
      uses: astral-sh/setup-uv@v7
      with:
        enable-cache: true
    
    - name: Set up Python
      run: uv python install 3.14
    
    - name: Install dependencies
      run: uv sync

    - name: Run checks
      run: make check
    
    - name: Restore clean lockfile
      run: git checkout -- uv.lock

    - name: Build package
      run: uv build
    
    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@v1.13.0
