python-publish.yml

# .github/workflows/upload-python-package.yml
name: Upload Python Package

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing release tag (e.g., v1.2.3)"
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Resolve tag
        id: resolve
        shell: bash
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "TAG=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "TAG=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
          fi
          echo "Resolved tag: $(cat $GITHUB_OUTPUT)"

      # Check out the code exactly at the release tag so you publish the right bits
      - name: Check out
        uses: actions/checkout@v4
        with:
          ref: refs/tags/${{ steps.resolve.outputs.TAG }}
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      - name: Install build & twine
        run: |
          python -m pip install --upgrade pip
          pip install build twine bump2version

      - name: Bump version to release tag
        run: |
          # Extract version from tag (e.g., v1.2.3 -> 1.2.3)
          VERSION="${{ steps.resolve.outputs.TAG }}"
          VERSION="${VERSION#v}"  # Remove 'v' prefix if present
          echo "Bumping version to: $VERSION"
          # Update version in files without committing/tagging
          bumpversion --new-version "$VERSION" --allow-dirty --no-commit --no-tag patch

      - name: Build dists
        run: python -m build

      - name: Upload to PyPI
        env:
          # tip: many projects use TWINE_USERNAME="__token__" and TWINE_PASSWORD=<pypi token>
          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
        run: |
          twine upload --skip-existing --verbose dist/*