publish-python.yml

name: Publish Python SDK
on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: Published release tag to upload or retry
        required: true
        type: string
permissions:
  contents: read
concurrency:
  group: pypi-${{ inputs.tag || github.event.release.tag_name }}
  cancel-in-progress: false
jobs:
  build:
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: ${{ inputs.tag || github.event.release.tag_name }}
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag || github.event.release.tag_name }}
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Verify published release and package version
        run: |
          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]
          test "$(gh release view "$RELEASE_TAG" --json isDraft --jq .isDraft)" = false
          python -m pip install build twine
          python - <<'PYTHON'
          import os
          from pathlib import Path
          from runpy import run_path
          from packaging.version import Version
          version = run_path(str(Path('python/jms_pam/_version.py')))['__version__']
          assert Version(version) == Version(os.environ['RELEASE_TAG'][1:]), 'Python package version must match the release tag'
          PYTHON
      - name: Build and validate distributions
        run: |
          python -m build --outdir dist python
          python -m twine check dist/*
      - uses: actions/upload-artifact@v4
        with:
          name: python-distributions
          path: dist/*
          if-no-files-found: error
  publish:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/jms-pam/
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: python-distributions
          path: dist
      - name: Publish to PyPI with Trusted Publishing
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true