release.yml

name: Release on tag

on:
  push:
    # Trigger when a semver-like tag is pushed (e.g. v1.2.3)
    tags:
      - 'v*.*.*'

permissions:
  contents: write
  id-token: write

jobs:
  release:
    name: Build and Release
    runs-on: ubuntu-latest
    env:
      CLOUDSMITH_OWNER: ${{ secrets.CLOUDSMITH_OWNER }}
      CLOUDSMITH_REPOSITORY: ${{ secrets.CLOUDSMITH_REPOSITORY }}
      CLOUDSMITH_SERVICE_SLUG: ${{ secrets.CLOUDSMITH_SERVICE_SLUG }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install build tooling
        run: |
          python -m pip install --upgrade pip
          pip install build wheel setuptools setuptools-scm


      - name: Build package (sdist + wheel)
        run: |
          python -m build
          ls -la dist

      - name: Create GitHub Release and upload assets
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          generate_release_notes: true
          files: |
            dist/*.whl
            dist/*.tar.gz

      - name: Install and authenticate Cloudsmith CLI (OIDC)
        uses: cloudsmith-io/cloudsmith-cli-action@v2
        with:
          oidc-namespace: ${{ env.CLOUDSMITH_OWNER }}
          oidc-service-slug: ${{ env.CLOUDSMITH_SERVICE_SLUG }}

      - name: Upload package to Cloudsmith
        env:
          OWNER: ${{ env.CLOUDSMITH_OWNER }}
          REPO: ${{ env.CLOUDSMITH_REPOSITORY }}
        run: |
          set -euo pipefail
          echo "Uploading to Cloudsmith: ${OWNER}/${REPO}"
          for file in dist/*.{tar.gz,whl}; do
            cloudsmith push python "${OWNER}/${REPO}" "$file"
          done
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1