publish.yml

name: Publish to PyPI / GitHub

on:
  workflow_dispatch:
  push:
    tags:
      - "v*"

permissions:
  contents: read

env:
  PYTHON_VERSION: "3.14"

jobs:
  build:
    name: "Build the project"
    runs-on: ubuntu-latest

    outputs:
      prerelease: ${{ steps.check-version.outputs.prerelease }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup uv
        uses: astral-sh/setup-uv@v5
        with:
          version: "latest"
          python-version: ${{ env.PYTHON_VERSION }}
          enable-cache: true
          cache-suffix: "publish-py${{ env.python-version }}"

      - name: Install dependencies
        run: |
          # We only need the project dependencies, no development deps
          uv sync --no-default-groups

      - name: Make sure pyproject.toml version matches git version
        run: |
          git_version=$(git describe --tags)
          pyproject_version=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")

          if [ "$git_version" != "v$pyproject_version" ]; then
            echo "The version specified in pyproject.toml (v$pyproject_version) doesn't match the git version ($git_version)"
            echo "You most likely forgot to update pyproject.toml when publishing the release tag"
            echo "You can fix this by updating the pyproject version and overwriting the git tag"
            exit 1
          fi

      - name: Build the project
        run: uv build

      - name: Upload build files
        uses: actions/upload-artifact@v4
        with:
          name: "dist"
          path: "dist/"
          if-no-files-found: error
          retention-days: 5

  publish-github:
    name: "Publish a GitHub release"
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Download the distribution files from PR artifact
        uses: actions/download-artifact@v4
        with:
          name: "dist"
          path: "dist/"

      - name: Create Release
        uses: ncipollo/release-action@v1
        with:
          artifacts: "dist/*"
          draft: false

  publish-pypi:
    name: "Publish to PyPI"
    needs: build
    runs-on: ubuntu-latest
    permissions:
      # Used to authenticate to PyPI via OIDC.
      id-token: write

    steps:
      - name: Download the distribution files from PR artifact
        uses: actions/download-artifact@v4
        with:
          name: "dist"
          path: "dist/"

      # This uses PyPI's trusted publishing, so no token is required
      - name: Release to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1