publish.yml

name: Publish to PyPI

on:
  release:
    types: [published]

jobs:
  build:
    name: Build distribution
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: '3.12'

      - name: Install build tooling
        run: python -m pip install --upgrade build twine

      - name: Verify tag matches pyproject version
        run: |
          # Release tags must start with `v` followed by a PEP 440 version (e.g. v1.2.3, v1.2.3a1).
          if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9] ]]; then
            echo "Release tag '$GITHUB_REF_NAME' must start with 'v' followed by a digit (e.g. v1.0.0)" >&2
            exit 1
          fi
          tag="${GITHUB_REF_NAME#v}"
          pkg_version=$(python -c "import tomllib,pathlib; print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")
          if [ "$tag" != "$pkg_version" ]; then
            echo "Release tag ($tag) does not match pyproject.toml version ($pkg_version)" >&2
            exit 1
          fi

      - name: Build sdist and wheel
        run: python -m build

      - name: Check distribution metadata
        run: python -m twine check --strict dist/*

      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
        with:
          name: dist
          path: dist/

  publish:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/hotdata
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
        with:
          name: dist
          path: dist/

      - name: Publish via Trusted Publishing
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0