release.yml

name: release
on:
  workflow_dispatch: {}
  push:
    branches:
      - main

jobs:
  release:
    if: ${{ startsWith(github.event.head_commit.message, 'Release') || github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
    - uses: actions/checkout@v4
    - name: Install uv
      uses: astral-sh/setup-uv@v2
    - name: Set up Python
      run: uv python install

    # https://docs.pypi.org/trusted-publishers/using-a-publisher/
    - name: Mint API token
      id: mint-token
      run: |
        # retrieve the ambient OIDC token
        resp=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
          "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=pypi")
        oidc_token=$(jq -r '.value' <<< "${resp}")

        # exchange the OIDC token for an API token
        resp=$(curl -X POST https://pypi.org/_/oidc/mint-token -d "{\"token\": \"${oidc_token}\"}")
        api_token=$(jq -r '.token' <<< "${resp}")

        # mask the newly minted API token, so that we don't accidentally leak it
        echo "::add-mask::${api_token}"

        # see the next step in the workflow for an example of using this step output
        echo "api-token=${api_token}" >> "${GITHUB_OUTPUT}"

    - name: Publish packages
      run: ./scripts/publish
      env:
        UV_PUBLISH_TOKEN: ${{ steps.mint-token.outputs.api-token }}