release-2-publish.yml

name: Release Step 2 - Publish to PyPI
run-name: publish to pypi

on:
  workflow_run:
    workflows: ["Release Step 1 - Release on GitHub"] # Must match name exactly
    types: [completed]
  workflow_dispatch:
    inputs:
      ref:
        description: "Branch or tag to publish"
        default: "main"
        required: false

jobs:
  pypi-publish:
    # Only run if Step 1 was successful, or if triggered manually
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    name: Build and publish Python package
    runs-on: ubuntu-latest
    environment: release

    permissions:
      id-token: write # Required for PyPI Trusted Publishing
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          # Use branch from trigger, or default to main
          ref: ${{ github.event.workflow_run.head_branch || inputs.ref || 'main' }}

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version-file: "pyproject.toml"

      - name: Build package
        run: uv build

      - name: Publish package to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          print-hash: true