release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    name: Test before release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Quality gate
        run: |
          ruff check .
          mypy src
          pytest

  package:
    name: Build Python package
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Build
        run: |
          python -m pip install --upgrade pip build
          python -m build

      - name: Check that the tag matches the package version
        run: |
          tag="${GITHUB_REF_NAME#v}"
          version="$(python -c 'import tomllib,pathlib;print(tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"])')"
          echo "tag=$tag package=$version"
          test "$tag" = "$version"

      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  docker:
    name: Publish image to GHCR
    runs-on: ubuntu-latest
    needs: test
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3

      # GITHUB_TOKEN is minted per run; no credentials are ever stored here.
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Derive tags and labels
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  release:
    name: Create GitHub release
    runs-on: ubuntu-latest
    needs: [package, docker]
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist

      - name: Publish release
        uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          generate_release_notes: true
          body: |
            ## Container image

            ```bash
            docker pull ghcr.io/${{ github.repository }}:${{ github.ref_name }}
            ```

            ## Reminder

            Results reported as `POSSIBLY_AVAILABLE` are not guaranteed to be
            registrable. Always verify a candidate directly with Instagram.

  pypi:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    needs: release
    # Opt-in: create a repository environment named "pypi" with trusted
    # publishing configured. Without it, this job is skipped and the release
    # still succeeds.
    if: vars.PUBLISH_TO_PYPI == 'true'
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist

      # Trusted publishing (OIDC): no API token is stored in this repository.
      - uses: pypa/gh-action-pypi-publish@release/v1