release.yml

# Pushing a tag vX.Y.Z publishes that version to PyPI through trusted
# publishing: no token lives in the repository secrets. It needs, once per
# package, a (pending) publisher on pypi.org pointing at this repository,
# this workflow file and the `pypi` environment.
name: release

on:
  push:
    tags: ["v*"]

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Install uv
        uses: astral-sh/setup-uv@v7
      - name: Tag matches the package version
        run: |
          version=$(uv version --short)
          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
            echo "tag $GITHUB_REF_NAME does not match pyproject version $version" >&2
            exit 1
          fi
      - run: uv sync --locked
      - run: uv run pytest
      - run: uv build
      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/

  publish:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/${{ github.event.repository.name }}/
    permissions:
      id-token: write
      contents: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1
      - name: GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --generate-notes