release.yml

name: Release

# Triggered by pushing a semver tag, e.g. `git tag v3.0.1 && git push origin v3.0.1`.
# Replaces the old auto-bump-on-every-push workflow with a deliberate,
# tag-driven build + publish flow.
on:
  push:
    tags:
      - "v*"

jobs:
  build:
    name: Build distribution
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Poetry
        run: python -m pip install --upgrade pip poetry

      - name: Verify tag matches package version
        run: |
          PKG_VERSION="$(poetry version --short)"
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          echo "pyproject version: $PKG_VERSION | tag: $TAG_VERSION"
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            echo "::error::Tag '$TAG_VERSION' does not match pyproject.toml version '$PKG_VERSION'."
            exit 1
          fi

      # Fail fast if the committed SBOM has drifted from poetry.lock. Because the
      # SBOM's root version is read from pyproject (verified == tag above), a
      # passing check also guarantees the SBOM version matches the release tag.
      - name: Verify SBOM is up to date
        run: python scripts/generate_sbom.py --check

      - name: Build sdist and wheel
        run: poetry build

      - name: Check metadata
        run: |
          python -m pip install twine
          twine check dist/*

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

      # Uploaded separately from `dist/` so the PyPI publish step (which uploads
      # everything in the dist artifact) never sees a non-package file.
      - name: Upload SBOM artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json

  pypi-publish:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    # Requires a PyPI "Trusted Publisher" configured for this repo + workflow +
    # the `pypi` environment (no API token stored as a secret). See docs/RELEASING.md.
    environment:
      name: pypi
      url: https://pypi.org/p/metasploit-mcp
    permissions:
      id-token: write  # OIDC token for PyPI Trusted Publishing
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  github-release:
    name: Create GitHub Release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write  # create the release and upload assets
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Download SBOM artifact
        uses: actions/download-artifact@v4
        with:
          name: sbom
          path: sbom/

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/*
            sbom/sbom.json
          generate_release_notes: true