name: Developer Meta-package Release

on:
  push:
    tags:
      - "v*"

jobs:
  publish-package:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          fetch-depth: 0
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: "3.12"
      - name: Validate protected release tag and package version
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          python - <<'PY'
          import fnmatch
          import json
          import os
          from pathlib import Path
          import subprocess
          import tomllib
          import urllib.request

          tag = os.environ["GITEA_REF_NAME"]
          project = tomllib.loads(Path("packages/govoplan-meta/pyproject.toml").read_text(encoding="utf-8"))["project"]
          if tag != f"v{project['version']}":
              raise SystemExit("meta-package version does not match the release tag")
          if subprocess.run(["git", "merge-base", "--is-ancestor", "HEAD", "origin/main"]).returncode:
              raise SystemExit("release tag is not contained in main")
          request = urllib.request.Request(
              f"{os.environ['GITEA_API_URL']}/repos/{os.environ['GITEA_REPOSITORY']}/tag_protections",
              headers={"Authorization": f"token {os.environ['GITEA_TOKEN']}"},
          )
          with urllib.request.urlopen(request, timeout=30) as response:
              protections = json.load(response)
          if not any(fnmatch.fnmatchcase(tag, item.get("name_pattern", "")) for item in protections):
              raise SystemExit("release tag is not protected")
          PY
      - name: Build and publish developer package
        env:
          PACKAGE_USERNAME: ${{ secrets.GOVOPLAN_PACKAGE_USERNAME }}
          PACKAGE_TOKEN: ${{ secrets.GOVOPLAN_PACKAGE_TOKEN }}
        run: |
          set -euo pipefail
          test -n "$PACKAGE_USERNAME"
          test -n "$PACKAGE_TOKEN"
          python -m pip install --disable-pip-version-check build==1.5.0 twine==7.0.0
          python -m build --wheel --outdir dist packages/govoplan-meta
          python -m twine check dist/*.whl
          TWINE_USERNAME="$PACKAGE_USERNAME" TWINE_PASSWORD="$PACKAGE_TOKEN" \
            python -m twine upload --non-interactive \
              --repository-url https://git.add-ideas.de/api/packages/GovOPlaN/pypi \
              dist/*.whl