name: Publish Python Package

on:
  release:
    types: [created]

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]

    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - uses: astral-sh/setup-uv@6b9c6063abd6010835644d4c2e1bef4cf5cd0fca # v6.0.1
      with:
        version: "latest"

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
      with:
        python-version: ${{ matrix.python-version }}

    - name: Start MySQL
      run: |
        sudo /etc/init.d/mysql start

    - name: Install dependencies
      run: uv sync --all-extras -p ${{ matrix.python-version }}

    - name: Wait for MySQL connection
      run: |
        while ! mysqladmin ping --host=localhost --port=3306 --user=root --password=root --silent; do
          sleep 5
        done

    - name: Pytest / behave
      env:
        PYTEST_PASSWORD: root
        PYTEST_HOST: 127.0.0.1
      run: |
        uv run tox -e py${{ matrix.python-version }}

      # arguably this should be made identical to CI for PRs
    - name: Run Style Checks
      run: uv run tox -e style

  build:
    runs-on: ubuntu-latest
    needs: [test]

    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - uses: astral-sh/setup-uv@6b9c6063abd6010835644d4c2e1bef4cf5cd0fca # v6.0.1
      with:
        version: "latest"

    - name: Set up Python
      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
      with:
        python-version: '3.13'

    - name: Install dependencies
      run: uv sync --all-extras -p 3.13

    - name: Build
      run: uv build

    - name: Store the distribution packages
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
      with:
        name: python-packages
        path: dist/

  publish:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    needs: [build]
    environment: release
    permissions:
      id-token: write
    steps:
    - name: Download distribution packages
      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
      with:
        name: python-packages
        path: dist/
    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4