OpenBB/.github/workflows/publish-openbb-sec.yml

name: 📦 publish openbb-sec

# Triggers exclusively on the merge of a ``release/openbb-sec-v*`` branch into
# ``develop`` (or ``v5``). No push / tag triggers. Four sequential jobs —
# verify the version bump, build once, test the built source across the full
# cross-platform matrix, and only publish to PyPI if the entire matrix is
# green. The matrix stops at 3.14 because the provider's lxml dependency has no
# prerelease (3.15) wheels yet.

on:
  pull_request:
    types: [closed]
    branches: [develop, v5]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  version-check:
    name: Verify version bump
    if: ${{ (github.event_name == 'pull_request' && github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/openbb-sec-v')) || github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.parse.outputs.version }}
    defaults:
      run:
        shell: bash
        working-directory: openbb_platform/providers/sec
    steps:
      - uses: actions/checkout@v6
        with:
          ref: develop

      - name: Parse [project].version from pyproject.toml
        id: parse
        run: |
          VERSION=$(grep -m1 -E '^version[[:space:]]*=' pyproject.toml | sed -E 's/^version[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/')
          if [ -z "$VERSION" ]; then
            echo "::error::Could not parse [project].version from pyproject.toml."
            exit 1
          fi
          echo "Local version: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Fail if version already exists on PyPI
        env:
          VERSION: ${{ steps.parse.outputs.version }}
        run: |
          STATUS=$(curl -sS -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/openbb-sec/${VERSION}/json")
          case "$STATUS" in
            200)
              echo "::error::openbb-sec ${VERSION} is already published on PyPI."
              echo "Bump openbb_platform/providers/sec/pyproject.toml [project].version and re-merge a fresh release branch."
              exit 1
              ;;
            404)
              echo "openbb-sec ${VERSION} is not yet on PyPI — proceeding."
              ;;
            *)
              echo "::error::Unexpected status $STATUS from PyPI JSON API. Aborting to avoid a silent skip."
              exit 1
              ;;
          esac

      - name: Verify release branch name matches pyproject version
        if: github.event_name == 'pull_request'
        env:
          VERSION: ${{ steps.parse.outputs.version }}
          BRANCH: ${{ github.event.pull_request.head.ref }}
        run: |
          EXPECTED="release/openbb-sec-v${VERSION}"
          if [ "$BRANCH" != "$EXPECTED" ]; then
            echo "::error::Release branch '${BRANCH}' does not match pyproject version '${VERSION}'."
            echo "Expected branch name: '${EXPECTED}'."
            echo "Either rename the release branch or update [project].version in pyproject.toml so they agree."
            exit 1
          fi
          echo "Branch '${BRANCH}' matches pyproject version '${VERSION}'."

  build:
    name: Build sdist + wheel
    needs: version-check
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: openbb_platform/providers/sec
    steps:
      - uses: actions/checkout@v6
        with:
          ref: develop

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - run: python -m pip install --upgrade pip uv

      - name: Build sdist + wheel
        run: uv build --no-sources

      - uses: actions/upload-artifact@v4
        with:
          name: openbb-sec-dist
          path: openbb_platform/providers/sec/dist/
          if-no-files-found: error
          retention-days: 7

  test:
    name: Test (${{ matrix.os }} / Python ${{ matrix.python_version }})
    needs: build
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux: full sweep across every released Python.
          - { os: ubuntu-latest, python_version: "3.10" }
          - { os: ubuntu-latest, python_version: "3.11" }
          - { os: ubuntu-latest, python_version: "3.12" }
          - { os: ubuntu-latest, python_version: "3.13" }
          - { os: ubuntu-latest, python_version: "3.14" }
          # macOS + Windows: min and max supported.
          - { os: macos-latest, python_version: "3.10" }
          - { os: macos-latest, python_version: "3.14" }
          - { os: windows-latest, python_version: "3.10" }
          - { os: windows-latest, python_version: "3.14" }
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash
        working-directory: openbb_platform/providers/sec
    steps:
      - uses: actions/checkout@v6
        with:
          ref: develop

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python_version }}
          allow-prereleases: true

      - run: python -m pip install --upgrade pip uv

      - name: Install openbb-sec from source (+ dev group)
        run: |
          uv pip install --system -e .
          uv pip install --system --group dev

      - name: Run unit tests
        run: pytest tests --cov=openbb_sec --cov-report=term-missing

  publish:
    name: Publish to PyPI
    needs: test
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # required for PyPI OIDC trusted publishing
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: openbb-sec-dist
          path: dist

      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist