python-package.yml

name: python-package

on:
  push:
    branches: [main, dev]
    paths:
      - ".github/workflows/python-package.yml"
      - "LICENSE"
      - "plugins/claude-code/**"
      - "python/**"
      - "scripts/run-no-key-mvp-demo.py"
      - "scripts/sync-python-package-assets.py"
      - "scripts/validate-python-distribution.py"
  pull_request:
    branches: [main, dev]
    paths:
      - ".github/workflows/python-package.yml"
      - "LICENSE"
      - "plugins/claude-code/**"
      - "python/**"
      - "scripts/run-no-key-mvp-demo.py"
      - "scripts/sync-python-package-assets.py"
      - "scripts/validate-python-distribution.py"
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: Build Python distributions
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
        with:
          python-version: "3.13"

      - name: Install pinned release tooling
        run: python -m pip install build==1.5.0 twine==6.2.0

      - name: Verify packaged assets are synchronized
        run: python scripts/sync-python-package-assets.py --check

      - name: Build wheel and source distribution
        run: python -m build --outdir dist .
        working-directory: python

      - name: Validate distribution contents and metadata
        run: |
          python scripts/validate-python-distribution.py --dist-dir python/dist
          python -m twine check --strict python/dist/*

      - name: Verify release tag and main ancestry
        if: github.event_name == 'release'
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          python scripts/validate-python-distribution.py \
            --dist-dir python/dist \
            --expected-tag "$RELEASE_TAG"
          git merge-base --is-ancestor "$GITHUB_SHA" origin/main

      - name: Record artifact digests
        run: sha256sum python/dist/*

      - name: Store distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: python-package-distributions
          path: python/dist/
          if-no-files-found: error
          retention-days: 14

  package-smoke:
    name: Wheel smoke (Python ${{ matrix.python-version }})
    needs: build
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.13"]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Retrieve distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: python-package-distributions
          path: dist

      - name: Install the wheel
        run: python -m pip install dist/ardur-*-py3-none-any.whl

      - name: Prove imports resolve outside the source checkout
        working-directory: ${{ runner.temp }}
        env:
          SOURCE_ROOT: ${{ github.workspace }}
        run: |
          python - <<'PY'
          import os
          from pathlib import Path
          import vibap

          installed = Path(vibap.__file__).resolve()
          source = Path(os.environ["SOURCE_ROOT"]).resolve()
          assert not installed.is_relative_to(source), (installed, source)
          print(f"installed-package={installed}")
          PY
          ardur --version

      - name: Run the installed PERMIT and DENY lifecycle
        working-directory: ${{ runner.temp }}
        run: python "$GITHUB_WORKSPACE/scripts/run-no-key-mvp-demo.py"

      - name: Verify packaged plugin protection path
        working-directory: ${{ runner.temp }}
        run: |
          mkdir package-project package-tmp
          cd package-project
          ardur profile init --template read-only --path ARDUR.md --json
          TMPDIR="$RUNNER_TEMP/package-tmp" ardur protect claude-code \
            --scope "$PWD" \
            --profile "$PWD/ARDUR.md" \
            --mode read-only \
            --home "$RUNNER_TEMP/ardur-home" \
            --json

  python-3-9-guard:
    name: Python 3.9 requirement guard
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Set up Python 3.9
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
        with:
          python-version: "3.9"

      - name: Retrieve distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: python-package-distributions
          path: dist

      - name: Require a clear Python 3.10 or newer error
        run: |
          set +e
          output="$(python -m pip install --no-deps dist/ardur-*-py3-none-any.whl 2>&1)"
          status=$?
          set -e
          printf '%s\n' "$output"
          test "$status" -ne 0
          grep -F "requires a different Python" <<<"$output"
          grep -F ">=3.10" <<<"$output"

  publish-testpypi:
    name: Publish to TestPyPI
    if: github.event_name == 'workflow_dispatch'
    needs: [build, package-smoke, python-3-9-guard]
    runs-on: ubuntu-latest
    environment:
      name: testpypi
      url: https://test.pypi.org/p/ardur
    permissions:
      id-token: write
    steps:
      - name: Retrieve distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: python-package-distributions
          path: dist

      - name: Publish distributions to TestPyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
        with:
          packages-dir: dist/
          repository-url: https://test.pypi.org/legacy/

  publish-pypi:
    name: Publish reviewed release to PyPI
    if: github.event_name == 'release' && github.event.release.prerelease == false
    needs: [build, package-smoke, python-3-9-guard]
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/ardur
    permissions:
      id-token: write
    steps:
      - name: Retrieve distributions
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: python-package-distributions
          path: dist

      - name: Publish distributions to PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
        with:
          packages-dir: dist/