release.yml

name: release

# To release this package:
# 1. Update the version number and changelog in the source.
#    Commit and push (to branch main or a vX.Y patch branch),
#    and wait for tests to complete.
# 2. Tag with "vX.Y" or "vX.Y.Z": either create and push tag
#    directly via git, or create and publish a GitHub release.
#
# This workflow will run in response to the new tag, and will:
#    - Verify the source code and git tag version numbers match
#    - Publish the package to PyPI
#    - Create or update the release on GitHub

on:
  push:
    tags: ["v[0-9]*"]
  workflow_dispatch:

permissions: {}

jobs:
  build:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    outputs:
      anchor: ${{ steps.version.outputs.anchor }}
      tag: ${{ steps.version.outputs.tag }}
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Get code
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.14"

      - name: Install build requirements
        run: |
          python -m pip install --upgrade build hatch twine

      - name: Get version
        # (This will end the workflow if git and source versions don't match.)
        id: version
        run: |
          VERSION="$(python -m hatch version)"
          TAG="v$VERSION"
          GIT_TAG="$(git tag -l --points-at "$GITHUB_REF" 'v*')"
          if [ "x$GIT_TAG" != "x$TAG" ]; then
            echo "::error ::package version '$TAG' does not match git tag '$GIT_TAG'"
            exit 1
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "anchor=${TAG//[^[:alnum:]]/-}" >> $GITHUB_OUTPUT

      - name: Build distribution
        run: |
          rm -rf build dist django_anymail.egg-info
          python -m build

      - name: Check metadata
        run: |
          python -m twine check dist/*

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/
          retention-days: 7

  publish:
    needs: [build]
    runs-on: ubuntu-22.04
    environment:
      name: pypi
      url: https://pypi.org/p/django-anymail
    permissions:
      # Required for PyPI trusted publishing
      id-token: write
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  release:
    needs: [build, publish]
    runs-on: ubuntu-22.04
    permissions:
      # `gh release` requires write permission on repo contents
      contents: write
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/
      - name: Release to GitHub
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.build.outputs.tag }}
          TITLE: ${{ needs.build.outputs.tag }}
          NOTES: |
            [Changelog](https://anymail.dev/en/stable/changelog/#${{ needs.build.outputs.anchor }})
        run: |
          if ! gh release edit "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --verify-tag \
            --target "$GITHUB_SHA" \
            --title "$TITLE" \
            --notes "$NOTES"
          then
            gh release create "$TAG" \
              --repo "$GITHUB_REPOSITORY" \
              --verify-tag \
              --target "$GITHUB_SHA" \
              --title "$TITLE" \
              --notes "$NOTES"
          fi
          gh release upload "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            ./dist/*