name: Publish Python package

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

jobs:
  publish:
    runs-on: haskelseed
    steps:
      - name: Check out source
        env:
          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
        run: |
          git clone --depth 1 \
            "https://tegwick:${PACKAGE_TOKEN}@gitea.coulomb.social/coulomb/kaizen-agentic.git" \
            repo
          cd repo
          git checkout "${{ gitea.sha }}"

      - name: Build and publish
        env:
          TWINE_USERNAME: ${{ secrets.PACKAGE_USER }}
          TWINE_PASSWORD: ${{ secrets.PACKAGE_TOKEN }}
        run: |
          cd repo
          python3 -m ensurepip --upgrade 2>/dev/null || \
            curl -sS https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py && python3 /tmp/get-pip.py
          python3 -m pip install --upgrade pip build twine
          python3 -m build
          python3 -m twine check dist/*
          python3 -m twine upload \
            --repository-url https://gitea.coulomb.social/api/packages/coulomb/pypi \
            dist/*