build-release.yaml

name: build-release
on:
  push:
    branches:
      - main

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [ "3.10", "3.11", "3.12" ]

    steps:
      - uses: actions/checkout@v4
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install -r test-requirements.txt
      - name: Test with pytest
        run: |
          pytest --cov=hostinger-api

  release:
    runs-on: ubuntu-latest
    needs: [build]
    permissions:
      contents: write
    outputs:
      new_version: ${{ steps.version.outputs.version }}
      released: ${{ steps.version.outputs.released }}

    steps:
      - name: Repo checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve version
        id: version
        run: |
          VERSION=$(grep -m1 '^version = ' pyproject.toml | sed -E 's/version = "(.*)"/\1/')
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
            echo "released=false" >> "$GITHUB_OUTPUT"
            echo "Tag v$VERSION already exists — skipping release."
          else
            echo "released=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Create release
        if: steps.version.outputs.released == 'true'
        uses: ncipollo/release-action@v1
        with:
          tag: v${{ steps.version.outputs.version }}
          generateReleaseNotes: true

  publish:
    runs-on: ubuntu-latest
    needs: [release]
    if: needs.release.outputs.released == 'true'
    permissions:
      id-token: write
    steps:
      - uses: actions/checkout@v3

      - uses: actions/setup-python@v4
        with:
          python-version: "3.x"

      - name: deps
        run: python -m pip install -U build

      - name: build
        run: python -m build

      - name: mint API token
        id: mint-token
        run: |
          # retrieve the ambient OIDC token
          resp=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=pypi")
          oidc_token=$(jq -r '.value' <<< "${resp}")

          # exchange the OIDC token for an API token
          resp=$(curl -X POST https://pypi.org/_/oidc/mint-token -d "{\"token\": \"${oidc_token}\"}")
          api_token=$(jq -r '.token' <<< "${resp}")

          # mask the newly minted API token, so that we don't accidentally leak it
          echo "::add-mask::${api_token}"

          # see the next step in the workflow for an example of using this step output
          echo "api-token=${api_token}" >> "${GITHUB_OUTPUT}"

      - name: publish
        # gh-action-pypi-publish uses TWINE_PASSWORD automatically
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ steps.mint-token.outputs.api-token }}

  notify-failure:
    needs: [build, release, publish]
    if: failure()
    runs-on: ubuntu-latest
    steps:
      - name: Notify Slack on release failure
        uses: slackapi/slack-github-action@v2.1.0
        with:
          errors: true
          webhook: ${{ secrets.PLATFORM_INCIDENT_SLACK_CHANNEL_WEBHOOK }}
          webhook-type: incoming-webhook
          payload: |
            text: ":rotating_light: Release failed in ${{ github.repository }}"
            blocks:
              - type: section
                text:
                  type: mrkdwn
                  text: |
                    :rotating_light: *Release failed:* `${{ github.repository }}`
                    *Commit:* <${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}|${{ github.sha }}>
              - type: actions
                elements:
                  - type: button
                    text:
                      type: plain_text
                      text: "View failed run"
                    url: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"