name: Release

# Builds the package, smoke-tests the wheel in a clean environment, and publishes to
# PyPI with Trusted Publishing (OIDC): no API token is stored in this repository.
#
# Triggered by publishing a GitHub Release. One-time PyPI setup and the release steps
# are in docs/RELEASING.md. Without the PyPI trusted-publisher entry, the publish job
# fails and nothing is uploaded.

on:
  release:
    types: [published]
  workflow_dispatch: # build and smoke-test only; the publish job is skipped

permissions:
  contents: read

jobs:
  build:
    name: Build and smoke-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"
      - name: Tag must match the package version
        if: github.event_name == 'release'
        env:
          TAG: ${{ github.event.release.tag_name }}
        run: |
          version=$(python -c "import re; print(re.search(r'__version__ = \"([^\"]+)\"', open('lumen_rag/__init__.py').read()).group(1))")
          if [ "$TAG" != "v$version" ]; then
            echo "release tag $TAG does not match lumen_rag.__version__ v$version"
            exit 1
          fi
      - run: python -m pip install build twine
      - run: python -m build
      - run: twine check dist/*
      - name: Smoke-test the wheel in a clean virtualenv
        run: |
          python -m venv "$RUNNER_TEMP/smoke"
          "$RUNNER_TEMP/smoke/bin/pip" install dist/*.whl
          cd "$RUNNER_TEMP"   # away from the checkout, so the installed package is what runs
          "$RUNNER_TEMP/smoke/bin/lumen" --help
          "$RUNNER_TEMP/smoke/bin/python" - <<'PY'
          import lumen_rag
          from lumen_rag.engine import RagEngine
          eng = RagEngine()
          eng.add_documents([{"id": "leave", "text": "Employees receive thirty working days of annual paid leave."}], chunk_size=50, overlap=0)
          result = eng.query("how many days of annual leave", k=1)
          assert result.citations and result.citations[0]["doc_id"] == "leave", result
          print("smoke test ok, version", lumen_rag.__version__)
          PY
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  publish:
    name: Publish to PyPI
    needs: build
    if: github.event_name == 'release'
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/lumen-rag
    permissions:
      id-token: write # the OIDC token PyPI exchanges for a short-lived upload credential
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2