release.yaml

name: Release

on:
  push:
    branches:
      - main
    tags:
      - "*"

permissions:
  contents: write # Needed to upload artifacts to the release
  id-token: write # Needed for OIDC PyPI publishing

jobs:
  build:
    name: Build Wheel and SDist
    runs-on: ubuntu-latest
    outputs:
      name: ${{ steps.baipp.outputs.package_name }}
      version: ${{ steps.baipp.outputs.package_version }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: hynek/build-and-inspect-python-package@fe0a0fb1925ca263d076ca4f2c13e93a6e92a33e # v2.17.0
        id: baipp

  publish:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    needs: [build]
    ## TODO: optionally provide the name of the environment for the trusted
    ## publisher on PyPI
    ## https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment
    # environment:
    #   name: pypi
    #   url: https://pypi.org/project/${{ needs.build.outputs.name }}/${{ needs.build.outputs.version }}
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: Packages
          path: dist
      - name: Publish
        ## TODO: create a trusted publisher on PyPI
        ## https://docs.pypi.org/trusted-publishers/
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0