# Publish torch-judge to PyPI when the package version changes on master, or manually.
#
# Setup (choose one):
#
# 1) Trusted Publishing (recommended, no token):
#    - On PyPI: Project → Publishing → Add a new pending publisher
#    - Owner: duoan (or your org), Repository: TorchCode, Workflow: pypi-publish.yml
#    - Then run this workflow once; PyPI will link the publisher.
#
# 2) API token:
#    - Add repository secret PYPI_API_TOKEN (value = pypi-... from pypi.org)
#    - The action will use TWINE_USERNAME=__token__ and TWINE_PASSWORD from secret.

name: Publish torch-judge to PyPI

on:
  push:
    branches:
      - master
    paths:
      - "pyproject.toml"
      - "setup.py"
      - "torch_judge/_version.py"
      - ".github/workflows/pypi-publish.yml"
  workflow_dispatch:

jobs:
  pypi-publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write  # for PyPI trusted publishing (OIDC)
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Decide whether to publish
        id: version
        env:
          GITHUB_EVENT_BEFORE: ${{ github.event.before }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
        run: |
          python - <<'PY'
          import os
          import pathlib
          import re
          import subprocess

          version_file = pathlib.Path("torch_judge/_version.py")
          version_re = re.compile(r'__version__\s*=\s*"([^"]+)"')

          def parse_version(text: str) -> str:
              match = version_re.search(text)
              if not match:
                  raise SystemExit("Could not parse __version__ from torch_judge/_version.py")
              return match.group(1)

          current = parse_version(version_file.read_text())
          previous = ""
          should_publish = os.environ["GITHUB_EVENT_NAME"] == "workflow_dispatch"

          before = os.environ.get("GITHUB_EVENT_BEFORE", "")
          if not should_publish and before and before != "0000000000000000000000000000000000000000":
              try:
                  previous_text = subprocess.check_output(
                      ["git", "show", f"{before}:torch_judge/_version.py"],
                      text=True,
                  )
              except subprocess.CalledProcessError:
                  previous_text = ""
              if previous_text:
                  previous = parse_version(previous_text)

          if not should_publish:
              should_publish = previous != current

          with pathlib.Path(os.environ["GITHUB_OUTPUT"]).open("a") as fh:
              fh.write(f"current={current}\n")
              fh.write(f"previous={previous}\n")
              fh.write(f"changed={'true' if should_publish else 'false'}\n")
          PY

      - name: Install build
        if: steps.version.outputs.changed == 'true'
        run: pip install build

      - name: Build package
        if: steps.version.outputs.changed == 'true'
        run: python -m build

      - name: Skip publish when version is unchanged
        if: steps.version.outputs.changed != 'true'
        env:
          PREVIOUS_VERSION: ${{ steps.version.outputs.previous }}
          CURRENT_VERSION: ${{ steps.version.outputs.current }}
        run: |
          echo "Version unchanged (${PREVIOUS_VERSION} -> ${CURRENT_VERSION}); skipping PyPI publish."

      - name: Publish to PyPI
        if: steps.version.outputs.changed == 'true'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true
          verbose: true