build-publish.yaml

---
# Automatically build and publish

name: Build and Publish

# yamllint disable-line rule:truthy
on:
  push:
    tags: ['v[0-9]+**']

jobs:
    sanity-check:
        name: Sanity Check
        runs-on: ubuntu-22.04
        steps:
            - name: Checkout
              uses: actions/checkout@v5
              with:
                ref: ${{ github.event.workflow_run.head_branch }}
                fetch-depth: 0

            - name: Check tag is releasable
              id: check_tag
              run: |
                  TAG_COMMIT=$(git rev-list -n 1 ${{ github.ref }})
                  ON_MAIN=$(git branch -r --contains $TAG_COMMIT | tr -d ' ' | grep -o '^origin/main$' || true)
                  IS_PRERELEASE=$(echo "${{ github.ref }}" | grep -oE 'v.*[^a-zA-Z][ab][0-9][0-9.-]*$' || true)
                  echo "on_main=$ON_MAIN" >> $GITHUB_OUTPUT
                  echo "is_prerelease=$IS_PRERELEASE" >> $GITHUB_OUTPUT
                  echo "ok=${ON_MAIN}${IS_PRERELEASE}" >> $GITHUB_OUTPUT

            - name: Fail if tag is not on main and not a prerelease version
              if: steps.check_tag.outputs.ok == ''
              run: |
                  echo "Tag is not on main and is not a prerelease version. Exiting."
                  exit 1

    # Look for a passing run of the testing workflow already tied to this
    # commit. Merges/pushes to main test the same SHA we tag, so full releases
    # normally already have a passing run and can skip the inline tests below.
    check-tests:
        name: Check for existing test run
        runs-on: ubuntu-22.04
        needs: sanity-check
        outputs:
            already_tested: ${{ steps.check.outputs.already_tested }}
        steps:
            - name: Look for a passing test run for this commit
              id: check
              env:
                GH_TOKEN: ${{ github.token }}
              run: |
                  SHA="${{ github.sha }}"
                  SUCCESS=$(gh api \
                    "repos/${{ github.repository }}/actions/workflows/testing.yaml/runs?head_sha=$SHA&status=completed" \
                    --jq '[.workflow_runs[] | select(.conclusion == "success")] | length')
                  if [ "${SUCCESS:-0}" -gt 0 ]; then
                      echo "Found $SUCCESS passing test run(s) for $SHA; skipping inline tests."
                      echo "already_tested=true" >> "$GITHUB_OUTPUT"
                  else
                      echo "No passing test run for $SHA; tests will run inline."
                      echo "already_tested=false" >> "$GITHUB_OUTPUT"
                  fi

    # Inline fallback: only runs when the tagged commit has no passing test
    # run yet (e.g. prereleases cut from commits that were never on main).
    run-tests:
        name: Run tests (inline fallback)
        needs: check-tests
        if: needs.check-tests.outputs.already_tested != 'true'
        uses: ./.github/workflows/testing.yaml
        secrets: inherit

    build-python:
        name: Build & Publish
        runs-on: ubuntu-22.04
        env:
          UV_PRERELEASE: allow
          PIP_PRE: 1
        permissions:
            id-token: write
        needs: [sanity-check, check-tests, run-tests]
        # Proceed when tests are known good: either a pre-existing passing run
        # (run-tests skipped) or a successful inline run. !failure() lets a
        # skipped run-tests through while still blocking on any real failure.
        if: ${{ !failure() && !cancelled() }}
        steps:
            - name: Apt update and build install
              shell: bash
              run: |
                  sudo apt update || true
                  sudo apt install -y nodejs npm python3-pip || true
                  pip install uv
            - name: Checkout
              uses: actions/checkout@v5
              with:
                ref: ${{ github.event.workflow_run.head_branch }}

            - name: make build
              shell: bash
              run: |
                  make build

            - name: Publish package distributions to PyPI
              uses: pypa/gh-action-pypi-publish@release/v1

    build-deploy-npm:
        name: Build & Publish
        runs-on: ubuntu-22.04
        needs: [sanity-check, check-tests, run-tests]
        # See build-python: proceed on a pre-existing pass or a successful
        # inline run, block on any real failure.
        if: ${{ !failure() && !cancelled() }}
        permissions:
            id-token: write
        steps:
            - uses: actions/setup-node@v6
              with:
                node-version: '24.x'
                registry-url: 'https://registry.npmjs.org'
            - name: Checkout
              uses: actions/checkout@v5
              with:
                ref: ${{ github.event.workflow_run.head_branch }}

            - name: Check if prerelease
              id: prerelease_tag
              run: |
                  PRERELEASE_TAG=$(echo "${{ github.ref }}" | grep -oE 'v.*[^a-zA-Z][ab][0-9][0-9.-]*$' >/dev/null 2>/dev/null && echo " --tag next" || echo "" )
                  echo prerelease_tag=$PRERELEASE_TAG >> $GITHUB_OUTPUT

            - name: npm build beaker-ts
              working-directory: beaker-ts
              shell: bash
              run: |
                npm i
                npm run build
                npm publish --provenance --access public ${{ steps.prerelease_tag.outputs.prerelease_tag }}

            - name: npm build beaker-vue
              working-directory: beaker-vue
              shell: bash
              run: |
                npm i
                npm run build
                npm publish --provenance --access public ${{ steps.prerelease_tag.outputs.prerelease_tag }}