publish.yaml

name: Build and upload to PyPI

on:
  workflow_dispatch: # run on request (no need for PR)
  release:
    types: [published]

# Declare default permissions as read only.
permissions: read-all

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Python 3.10
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: "3.10"
      - name: Install pypa/build
        run: |
          python -m pip install --require-hashes --no-deps -r .ci/requirements.txt
          pip-compile --generate-hashes --output-file=/tmp/requirements.txt --extra=ci_publish pyproject.toml
          python -m pip install --require-hashes --no-deps -r /tmp/requirements.txt
          rm /tmp/requirements.txt
      - name: Build sdist
        run: python -m build --sdist
      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: artifact-sdist
          path: dist/*.tar.gz
      - name: Build wheel
        run: python -m build --wheel
      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: artifact-wheel
          path: dist/*.whl

  publish_package:
    name: Publish package
    needs: [build]
    environment: pypi
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: write
      id-token: write
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          path: dist
          pattern: artifact-*
          merge-multiple: true
      # to determine where to publish the package distribution to PyPI or TestPyPI
      - name: Check tag
        id: check-tag
        uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2.0.2
        with:
          text: ${{ github.ref }}
          regex: '^refs/tags/[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+rc[0-9]+|rc[0-9]+)?$'
      - name: Upload package distributions to github
        if: ${{ steps.check-tag.outputs.match != '' }}
        uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: dist/*
          tag: ${{ github.ref }}
          overwrite: true
          file_glob: true
      - name: Publish package distributions to PyPI
        if: ${{ steps.check-tag.outputs.match != '' }}
        uses: pypa/gh-action-pypi-publish@67339c736fd9354cd4f8cb0b744f2b82a74b5c70 # v1.12.3
      - name: Publish package distributions to TestPyPI
        if: ${{ steps.check-tag.outputs.match == '' }}
        uses: pypa/gh-action-pypi-publish@67339c736fd9354cd4f8cb0b744f2b82a74b5c70 # v1.12.3
        with:
          repository-url: https://test.pypi.org/legacy/
          verbose: true