publish-manually.yml

name: Build and upload to PyPi manually

permissions:
  contents: read

on:
  workflow_dispatch:
    inputs:
      upload:
        description: 'Upload to PyPI'
        type: boolean
        required: false
        default: false

      python-version:
        description: 'Python version to run on'
        type: string
        required: false
        default: "3.13"

      target:
        description: "Target os to build for: linux,macos,windows"
        type: string
        required: false
        default: "linux,macos-x86,macos-arm,windows,linux-aarch64"

      target_tag:
        description: "Publish particular tag"
        type: string
        required: false
        default: ""

      ignore_tests:
        description: "Don't run tests"
        type: boolean
        required: false
        default: false

jobs:
  build-and-publish:
    name: "Build wheels"
    uses: ./.github/workflows/lib-build.yml
    with:
      python-version: ${{ inputs.python-version }}
      ignore_tests: ${{ inputs.ignore_tests }}
      target_tag: ${{ inputs.target_tag }}
      target: ${{ inputs.target }}

  # Publishing is a separate job (not inside the reusable workflow) because PyPI Trusted Publishing
  # requires the *caller* workflow path in the OIDC token. A reusable workflow would embed its own
  # path instead, causing an `invalid-publisher` error on the PyPI side.
  # See: https://github.com/pypa/gh-action-pypi-publish/issues/166
  publish:
    name: "Publish wheels to PyPi"
    needs: build-and-publish
    if: inputs.upload
    runs-on: ubuntu-24.04
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: dist
          merge-multiple: true

      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          skip-existing: true