name: pypi

on:
  push:
    branches: main
    tags: v*

jobs:
  publish-test:
    name: Build and publish to TestPyPI
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python 3.9
        uses: actions/setup-python@v5
        with:
          python-version: 3.9
      - name: Install pypa/build
        run: >-
          python -m
          pip install
          build
          setuptools
          --user
      - name: Set dev timestamp
        run: echo "DEV_BUILD=$(date +%s)" >> $GITHUB_ENV
      - name: Build binary wheel and source tarball
        run: >-
          python -m
          build
          --sdist
          --wheel
          --outdir dist/
          .
      - name: Publish distribution to TestPyPI
        uses: pypa/gh-action-pypi-publish@master
        with:
          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
          repository_url: https://test.pypi.org/legacy/
  publish:
    # Gate real PyPI publishing to stable SemVer tags only
    if: startsWith(github.ref, 'refs/tags/')
    name: Build and publish to PyPI
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Check if stable release
        id: check_tag
        run: |
          TAG="${{ github.ref_name }}"
          if echo "$TAG" | grep -qE '^v?[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "is_stable=true" >> $GITHUB_OUTPUT
            echo "Tag '$TAG' is a stable release. Will publish to PyPI."
          else
            echo "is_stable=false" >> $GITHUB_OUTPUT
            echo "Tag '$TAG' is not a stable release (contains pre-release suffix). Skipping PyPI publish."
          fi
      - name: Set up Python 3.9
        if: steps.check_tag.outputs.is_stable == 'true'
        uses: actions/setup-python@v5
        with:
          python-version: 3.9
      - name: Install pypa/build
        if: steps.check_tag.outputs.is_stable == 'true'
        run: >-
          python -m
          pip install
          build
          --user
      - name: Build binary wheel and source tarball
        if: steps.check_tag.outputs.is_stable == 'true'
        run: >-
          python -m
          build
          --sdist
          --wheel
          --outdir dist/
          .
      - name: Publish distribution to PyPI
        if: steps.check_tag.outputs.is_stable == 'true'
        uses: pypa/gh-action-pypi-publish@master
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}