name: Publish Python SDK

on:
  push:
    tags:
      - 'python-sdk-v*'

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # PyPI Trusted Publishing (OIDC) — no PYPI_TOKEN secret needed
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Run tests before publish
        working-directory: packages/python-sdk
        run: |
          pip install -e ".[dev]"
          pytest
      - name: Build
        working-directory: packages/python-sdk
        run: |
          pip install build
          python -m build
      - name: Publish to PyPI (Trusted Publishing / OIDC)
        # Requires a Trusted Publisher configured on PyPI for repo agentkitai/agentlens
        # with workflow name `publish-python-sdk.yml`. No token secret required.
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: packages/python-sdk/dist