publish.yml

name: Publish to PyPI

# Publishes to PyPI via OIDC trusted publishing whenever a GitHub release is
# published — no API token is stored anywhere. PyPI-side prerequisite: the
# project's Publishing settings must list this repo + workflow (publish.yml)
# + environment (pypi) as a trusted publisher.
on:
  release:
    types: [published]

jobs:
  build:
    name: Build distributions
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      # The release tag (vX.Y.Z) and pyproject.toml must agree, otherwise the
      # upload would publish a version that doesn't match the tagged source.
      - name: Check tag matches pyproject version
        run: |
          PKG_VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            echo "Tag $GITHUB_REF_NAME does not match pyproject version $PKG_VERSION" >&2
            exit 1
          fi

      - name: Build sdist and wheel
        run: |
          python -m pip install build twine
          python -m build
          python -m twine check dist/*

      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish:
    name: Publish (trusted publishing)
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/tanglebrain/
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - uses: pypa/gh-action-pypi-publish@release/v1