release.yml

name: Release

# 打 v* tag 即触发：跑测试 → 构建 → 经 OIDC Trusted Publishing 发 PyPI（无需任何 token）。
on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.8", "3.12"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - run: python -m pip install --upgrade pip
      - run: pip install -e ".[dev]"
      - run: ruff check .
      - run: pytest -q

  publish:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # OIDC：让 PyPI 信任此 workflow，免存 token
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Verify tag matches package version
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          VER="$(python -c "import pathlib,re;print(re.search(r'\"([^\"]+)\"', pathlib.Path('src/hiapi/_version.py').read_text()).group(1))")"
          echo "tag=$TAG  version=$VER"
          if [ "$TAG" != "$VER" ]; then
            echo "::error::tag v$TAG 与 src/hiapi/_version.py ($VER) 不一致，先改版本号再打 tag"
            exit 1
          fi

      - name: Build
        run: |
          python -m pip install --upgrade pip build
          python -m build

      - name: Publish to PyPI (OIDC Trusted Publishing)
        uses: pypa/gh-action-pypi-publish@release/v1