name: publish

# Build and publish obsidian-wiki to PyPI when a version tag is pushed.
#
# Setup (one-time): on PyPI, add a Trusted Publisher for this repo with
# workflow `publish.yml` and environment `pypi`. No API token needed — the
# `id-token: write` permission below mints a short-lived OIDC credential.
#
# Release: bump `version` in pyproject.toml, commit, then
#   git tag v0.1.0 && git push origin v0.1.0

on:
  push:
    tags:
      - "v*"
  # Allow a manual build (artifacts only, no publish) for verification.
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.x"
      - name: Build sdist and wheel
        run: |
          python -m pip install --upgrade build
          python -m build
      - name: Verify wheel bundles the skills
        run: |
          python -m pip install --upgrade twine
          twine check dist/*
          wheel=$(ls dist/*.whl)
          echo "Inspecting $wheel"
          if ! python -m zipfile -l "$wheel" | grep -q "obsidian_wiki/_data/skills/wiki-setup/SKILL.md"; then
            echo "::error::wheel is missing bundled skills under obsidian_wiki/_data/skills/"
            exit 1
          fi
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish:
    needs: build
    runs-on: ubuntu-latest
    # Only publish on a real tag push, not workflow_dispatch.
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    environment: pypi
    permissions:
      id-token: write  # required for PyPI Trusted Publishing (OIDC)
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true