release.yml

name: Publish packages

on:
  release:
    types: [released]

# Allow only one concurrent deployment
concurrency:
  group: "release"
  cancel-in-progress: false

jobs:
  build-package:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Setup python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b
        with:
            python-version: "3.x"

      - name: Install dependencies
        run: python3 -m pip install build

      - name: Build package
        run: python3 -m build

      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
        with:
          name: packages
          path: dist/
          retention-days: 10
          if-no-files-found: error

  pypi-publish:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    needs: build-package
    environment:
      name: release
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          name: packages
          path: dist/

      # External actions are disabled via organization policies therefore we
      # must instead manually implement it.
      # https://docs.pypi.org/trusted-publishers/using-a-publisher/#the-manual-way
      # - name: Publish package distributions to PyPI
      #   uses: pypa/gh-action-pypi-publish@release/v1

      - name: Setup python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b
        with:
            python-version: "3.x"

      - name: Install dependencies
        run: python -m pip install twine

      - name: Check package metadata
        run: python -m twine check --strict dist/*

      - name: Upload to PyPI
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
        run: python3 -m twine upload --disable-progress-bar --verbose --non-interactive dist/*