release.yaml

name: publish

on:
  release:
    types:
      - published
  push:
    branches: [master, main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
      with:
        fetch-depth: 0

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: 3.9

    - name: build
      run: |
        python -m pip install wheel twine build
        python -m build

    - name: Check files
      run: |
        ls dist
      shell: bash

    - name: Test wheels
      run: |
        python -m twine check --strict dist/*
      shell: bash

    - name: Upload dist files for publication
      uses: actions/upload-artifact@v4
      with:
        name: dist-files
        path: dist

  publish:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'release' }}
    needs: build
    # Run this job in an isolated GHA environment containing the OIDC credentials.
    environment: release
    permissions:
      id-token: write
    steps:
    - uses: actions/download-artifact@v4
      with:
        name: dist-files
        path: dist
    - name: Publish a Python distribution to PyPI
      uses: pypa/gh-action-pypi-publish@v1.10.3