Build and publish release artifacts workflow (vtuber-plan/olah)

name: Build and publish release artifacts
run-name: Build and publish release artifacts for ${{ github.ref_name }}
 
on:
  push:
    tags:
      - "v*"
 
permissions:
  contents: write
 
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false
 
jobs:
  build-and-release:
    timeout-minutes: 30
    name: Build wheel and publish GitHub release
    runs-on: latchkey-small
 
    steps:
      - name: Check out repository code
        uses: actions/checkout@v4
 
      - name: Set up Apache Arrow
        run: |
          sudo apt update
          sudo apt install -y -V ca-certificates lsb-release wget
          wget https://apache.jfrog.io/artifactory/arrow/$(lsb_release --id --short | tr 'A-Z' 'a-z')/apache-arrow-apt-source-latest-$(lsb_release --codename --short).deb
          sudo apt install -y -V ./apache-arrow-apt-source-latest-$(lsb_release --codename --short).deb
          sudo apt update
          sudo apt install -y -V libarrow-dev libarrow-glib-dev libparquet-dev libparquet-glib-dev
 
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          cache: 'pip'
          python-version: "3.12"
 
      - name: Install build dependencies
        run: |
          pip install --upgrade pip
          pip install -e .
          pip install -r requirements.txt
          pip install build twine
 
      - name: Validate tag matches package version
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PACKAGE_VERSION="$(python -c "from pathlib import Path; import tomllib; print(tomllib.loads(Path('pyproject.toml').read_text())['project']['version'])")"
          if [[ "${TAG_VERSION}" != "${PACKAGE_VERSION}" ]]; then
            echo "Tag version ${TAG_VERSION} does not match pyproject version ${PACKAGE_VERSION}" >&2
            exit 1
          fi
 
      - name: Test Olah
        run: python -m pytest tests
 
      - name: Build Olah
        run: python -m build
 
      - name: Check build artifacts
        run: python -m twine check dist/*
 
      - name: Publish package to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ secrets.PYPI_API_TOKEN }}
 
      - name: Publish GitHub release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          generate_release_notes: true
          prerelease: false
          files: |
            dist/*.tar.gz
            dist/*.whl