release-pypi.yaml

name: PyPI Release

on:
  push:
    tags:
    - v*.*.*

permissions: {}

jobs:
  build:
    name: Build and verify package
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0  # setuptools_scm needs tags

    - name: Verify tag points at a commit on main
      run: |
        git fetch origin main
        git merge-base --is-ancestor "$GITHUB_SHA" origin/main \
          || { echo "Tag $GITHUB_REF_NAME is not on main"; exit 1; }

    - uses: ./.github/actions/build-package

  release:
    name: Create GitHub release
    needs: [build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@v6
    - uses: softprops/action-gh-release@v3
      with:
        generate_release_notes: true

  publish:
    name: Publish to PyPI
    needs: [build]
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/${{ github.event.repository.name }}
    permissions:
      id-token: write
    steps:
    - uses: actions/download-artifact@v8
      with:
        name: Packages
        path: dist
    - uses: pypa/gh-action-pypi-publish@release/v1