stages:
  - test
  - pypi-twine

# ---------------------------------------------------------------------------
# Tests run on every push to any branch.
#
# Live-integration tests need EPMD on the runner — ``make all`` skips
# them automatically when EPMD isn't reachable. CI runners typically
# don't run EPMD, so we get unit-level coverage in CI and full
# integration coverage on the dev machine.
# ---------------------------------------------------------------------------
test:
  stage: test
  tags: ["build"]
  script:
    - python3 -m venv .venv
    - . .venv/bin/activate
    - pip install --upgrade pip wheel
    - pip install -e ".[dev]"
    - pytest -v

# ---------------------------------------------------------------------------
# Ship to PyPI on tag pushes.
#
# Tag the commit (``git tag -a v0.0.1 -m 'release'`` then
# ``git push --tags``) and CI builds sdist + wheel and uploads with
# twine. Credentials come from GitLab CI variables ``TWINE_USERNAME``
# (typically ``__token__``) and ``TWINE_PASSWORD`` (the PyPI API token).
# ---------------------------------------------------------------------------
pypi-twine:
  stage: pypi-twine
  tags: ["build"]
  only:
    - tags
  script:
    - python3 -m venv .venv
    - . .venv/bin/activate
    - pip install --upgrade pip
    # Pin twine <6 — newer twine auto-detects GitLab CI and refuses to
    # fall back to ~/.pypirc on the runner, requiring PYPI_ID_TOKEN
    # (Trusted Publishing OIDC) instead. Until we migrate all four
    # python/* repos to Trusted Publishing in one coordinated change,
    # stick with the classic ~/.pypirc path that ago / make_post_sell /
    # remarkbox already use.
    - pip install build "twine<6"
    - python -m build
    - twine check dist/*
    - twine upload --non-interactive dist/*