release.yml

# SPDX-License-Identifier: AGPL-3.0-or-later
name: release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing tag to (re)build and attest"
        required: true

permissions:
  contents: write # create/edit the GitHub release
  id-token: write # sigstore signing for provenance
  attestations: write # build-provenance attestations

jobs:
  release:
    name: build · SBOM · provenance · publish
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Install uv (pinned)
        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
        with:
          version: "0.11.19"
      - name: Build wheel + sdist
        run: uv build
      - name: Generate a runtime SBOM (CycloneDX)
        run: |
          uv sync --frozen --no-dev
          uvx cyclonedx-py environment .venv > dist/sbom.cdx.json
      - name: Attest build provenance (signed via Sigstore)
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
        with:
          subject-path: "dist/*.whl,dist/*.tar.gz"
      - name: Publish artifacts to the GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="${{ github.event.inputs.tag || github.ref_name }}"
          gh release view "$TAG" >/dev/null 2>&1 \
            || gh release create "$TAG" --title "habitable $TAG" --generate-notes
          gh release upload "$TAG" dist/* --clobber
      # Note: PyPI publishing via Trusted Publishing (OIDC) is the next step once a
      # PyPI project + trusted publisher are configured; see docs/releasing.md.