release.yml

name: ✨ release

on:
  release:
    types: [published]

permissions:
  contents: write
  id-token: write
  attestations: write

jobs:
  publish:
    name: publish artifacts
    timeout-minutes: 60
    runs-on: public-ledgerhq-shared-small
    steps:
      - name: Login to Ledger Artifactory
        timeout-minutes: 10
        id: jfrog-login
        uses: LedgerHQ/actions-security/actions/jfrog-login@actions/jfrog-login-1

      - name: Checkout
        timeout-minutes: 10
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: "recursive"

      - name: Setup python / PDM
        timeout-minutes: 10
        uses: ./.github/actions/pdm

      - name: Install dependencies
        timeout-minutes: 10
        run: |
          pdm install --dev --check --frozen-lockfile
          pdm install --plugins

      - name: Build library artifacts
        timeout-minutes: 10
        run: pdm build

      - name: Upload library artifacts to Ledger Artifactory repository
        timeout-minutes: 10
        env:
          PDM_PUBLISH_REPO: https://jfrog.ledgerlabs.net/artifactory/api/pypi/vault-pypi-prod-green
          PDM_PUBLISH_USERNAME: ${{ steps.jfrog-login.outputs.oidc-user }}
          PDM_PUBLISH_PASSWORD: ${{ steps.jfrog-login.outputs.oidc-token }}
        run: pdm publish --no-build

      - name: Upload library artifacts to PyPI
        timeout-minutes: 10
        env:
          PDM_PUBLISH_PASSWORD: ${{ secrets.PYPI_PUBLIC_API_TOKEN }}
        run: pdm publish --no-build

      - name: Generate library build attestations
        timeout-minutes: 10
        uses: LedgerHQ/actions-security/actions/attest@actions/attest-1
        with:
          subject-path: dist/*

      - name: Sign library artifacts
        timeout-minutes: 10
        uses: LedgerHQ/actions-security/actions/sign-blob@actions/sign-blob-1
        with:
          path: dist