release-python.yml

name: Release Python (PyPI)

# Reusable workflow — called only by release.yml (the orchestrator), never
# dispatched on its own (guarantees the JAR is released before PyPI).
# Auth: PyPI API token via the PYPI_API_TOKEN repo secret (passed by secrets: inherit).

on:
  workflow_call:
    inputs:
      version:
        description: 'Package version (X.Y.Z). Must match python/pyproject.toml.'
        required: true
        type: string

permissions:
  contents: write   # create the git tag at the end

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v5
        with: { python-version: '3.11' }

      - name: Verify pyproject.toml version matches the input
        working-directory: python
        run: |
          ACTUAL="$(grep -E '^version\s*=' pyproject.toml | head -1 | sed -E 's/.*"([^"]+)".*/\1/')"
          if [ "${{ inputs.version }}" != "$ACTUAL" ]; then
            echo "::error::pyproject.toml version ($ACTUAL) != input (${{ inputs.version }})"
            exit 1
          fi

      - name: Build sdist + wheel
        working-directory: python
        run: |
          python -m pip install --upgrade pip build
          python -m build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: python/dist
          password: ${{ secrets.PYPI_API_TOKEN }}

      - name: Create git tag
        run: |
          git tag python-v${{ inputs.version }}
          git push origin python-v${{ inputs.version }}