updates github ci policy

Author: fabricebrito

.github/workflows/package.yaml

@@ -1,74 +1,90 @@
-# Copyright 2025 Terradue
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: publish-to-pypi
-
-# on:
-#   release:
-#     types: [created]
+name: build-and-publish
+
 on:
   push:
     branches:
-    - develop
-    - main
+      - develop
+      - main
+    tags:
+      - 'v*.*.*'
 
 permissions:
-  id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
+  id-token: write   # required for trusted PyPI publishing
   contents: read
   packages: write
-  attestations: write
+
+env:
+  IMAGE_ID: ghcr.io/eoepca/eoap-cwlwrap/eoap-cwlwrap
 
 jobs:
-  deploy:
+
+  build:
 
     runs-on: ubuntu-latest
 
-    environment: release
-     
     steps:
-    - uses: actions/checkout@v4
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.10'
-        cache: 'pip'
-    - name: Install dependencies
-      run: |
-        # python -m pip install --upgrade pip 
-        pip install hatch nose2
-    - name: Build package
-      run: hatch build
-    - name: Test package
-      run: hatch test --verbose 
-    - name: Publish package distributions to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        skip-existing: true
-        repository-url: https://upload.pypi.org/legacy/
-  
-  container-build:
-    needs: deploy 
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: pip install hatch nose2
+
+      - name: Build package
+        run: hatch build
+
+      - name: Test package
+        run: hatch test --verbose
+
+      - name: Determine image tag
+        id: vars
+        run: |
+          if [[ "${GITHUB_REF}" == refs/heads/develop ]]; then
+            echo "IMAGE_TAG=latest-dev" >> $GITHUB_ENV
+          elif [[ "${GITHUB_REF}" == refs/heads/main ]]; then
+            echo "IMAGE_TAG=latest" >> $GITHUB_ENV
+          elif [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            VERSION=${GITHUB_REF#refs/tags/v}
+            echo "IMAGE_TAG=$VERSION" >> $GITHUB_ENV
+          fi
+
+      - name: Login to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+      - name: Build container
+        run: |
+          docker build . -f Dockerfile -t eoap-cwlwrap
+          docker tag eoap-cwlwrap $IMAGE_ID:${IMAGE_TAG}
+
+      - name: Push container
+        run: docker push $IMAGE_ID:${IMAGE_TAG}
+
+  publish-to-pypi:
+
+    # Only run for version tags
+    if: startsWith(github.ref, 'refs/tags/v')
+
     runs-on: ubuntu-latest
+    needs: build
+    environment: release
+
     steps:
-    - uses: actions/checkout@v4   
-    - run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-    - name: build & push image
-      run: |
-        version=$(grep -Eo '[0-9]+(\.[0-9]+){1,3}' src/eoap_cwlwrap/__about__.py | tail -1)
-        IMAGE_ID=ghcr.io/eoepca/eoap-cwlwrap/eoap-cwlwrap
-        docker build . --file Dockerfile --tag eoap-cwlwrap
-        docker tag eoap-cwlwrap $IMAGE_ID:$version
-        docker tag eoap-cwlwrap $IMAGE_ID:latest
-        docker push $IMAGE_ID:latest
-        docker push $IMAGE_ID:$version
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+
+      - name: Install hatch
+        run: pip install hatch
+
+      - name: Build package
+        run: hatch build
+
+      - name: Publish to PyPI (trusted publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1