name: release

on:
  push:
    tags:
      - "v*.*.*"

jobs:
  build-and-test:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v3

      - name: Sync base + optional extras
        run: uv sync --extra tcptrace --extra ndt7

      - name: Run test suite
        run: uv run pytest -q

      - name: Build wheel and sdist
        run: uv build

      - name: Verify extras install cleanly from the built wheel
        shell: bash
        run: |
          python -m venv /tmp/wheel-check
          /tmp/wheel-check/Scripts/pip install "$(ls dist/*.whl)[tcptrace,ndt7]"
          /tmp/wheel-check/Scripts/netsleuth --help

      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  # Publishing is intentionally a separate, manually-approved job: a tag push
  # builds and tests automatically, but a human still has to approve the
  # `pypi` environment before this job runs and actually publishes.
  #
  # "netsleuth" confirmed free on PyPI 2026-08-09 (pypi.org/pypi/netsleuth/json
  # -> 404). Before the first tag push actually publishes, still needed:
  #   1. Register a PyPI Trusted Publisher for this not-yet-published project
  #      name at https://pypi.org/manage/account/publishing/ — no token needed,
  #      this workflow's OIDC identity gets authorized directly on pypi.org.
  #      Owner: Horizontal42, repo: netsleuth, workflow: release.yml,
  #      environment: pypi.
  #   2. Create the `pypi` GitHub Environment (repo Settings → Environments)
  #      with a required-reviewer protection rule, so publishing needs a
  #      manual click even after the workflow triggers.
  publish:
    needs: build-and-test
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1