release.yml

name: release

on:
  release:
    # When a release is published, run the workflow
    types:
      - published
    branches:
      - main

jobs:
  build-and-test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/checkout@v4
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Poetry
        run: pip install poetry

      - name: Install Dependencies
        run: poetry install --with dev

      - name: Run Ruff (Formatting)
        run: poetry run ruff format

      - name: Run Ruff (Linting)
        run: poetry run ruff check

      - name: Run Bandit (Security Analysis)
        run: poetry run bandit -c pyproject.toml -r src

      - name: Run Mypy (Static Type Checking)
        run: poetry run mypy src

      - name: Run Pytest (Tests)
        run: poetry run coverage run --source=src -m pytest

      - name: Run Coverage (Report)
        run: poetry run coverage report -m --fail-under=90

  publish:
    needs: build-and-test
    runs-on: ubuntu-latest
    # if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/checkout@v4
        with:
          python-version: '3.12'

      - name: Install Poetry
        run: pip install poetry

      - name: Build and Publish
        env:
          PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        run: |
          poetry config pypi-token.pypi $PYPI_API_TOKEN
          poetry publish --build