test-publish.yml

name: Release (TestPyPI)

on:
  # Manual run for quick testing
  workflow_dispatch:
  # Optional: run on tags like v0.1.0
  push:
    tags: ["v*"]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - uses: astral-sh/setup-uv@v3

      - name: Install deps
        run: uv sync --all-extras --dev

      - name: Build dists
        run: uv run python -m build

      - name: Verify tag matches version (only on tag)
        if: startsWith(github.ref, 'refs/tags/')
        shell: bash
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PY_VER=$(python -c "import tomllib,sys;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
          if [ -z "$TAG" ]; then
            echo "No tag found in GITHUB_REF_NAME"; exit 1;
          fi
          [ "$PY_VER" = "$TAG" ] || { echo "Version $PY_VER != tag $TAG"; exit 1; }

      - name: Publish distribution 📦 to TestPyPI (OIDC)
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/
          verbose: true