on-release-publish.yml

name: py:publish

on:
  release:
    types: [ released ]

jobs:
  ghcr-publish:
    runs-on: ubuntu-latest
    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: ${{ github.repository }}
    permissions:
      attestations: write
      contents: read
      id-token: write
      packages: write

    steps:
    - name: Checkout commit
      uses: actions/checkout@v3
    - name: Log in to ghcr.io
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Extract metadata
      id: metadata
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
    - name: Build and push
      id: push
      uses: docker/build-push-action@v6
      with:
        context: .
        push: true
        tags: ${{ steps.metadata.outputs.tags }}
        labels: ${{ steps.metadata.outputs.labels }}
    - name: Generate artifact attestation
      uses: actions/attest-build-provenance@v1
      with:
        subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
        subject-digest: ${{ steps.push.outputs.digest }}
        push-to-registry: true

  pypi-publish:
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/rookify
    permissions:
      id-token: write

    steps:
    - name: Checkout commit
      uses: actions/checkout@v3
    - name: Get the Git tag name
      id: get-tag-name
      run: echo "tag-name=${GITHUB_REF/refs\/tags\/v/}" >> "$GITHUB_OUTPUT"
    - name: Set up Python
      id: setup-python
      uses: actions/setup-python@v3
    - name: Install dependencies
      run: |-
        pip install -r ./requirements.txt
        pip install build
    - name: Execute build
      env:
        ROOKIFY_VERSION: ${{ steps.get-tag-name.outputs.tag-name }}
      run: |-
        python -m build .
    - name: Publish package
      uses: pypa/gh-action-pypi-publish@release/v1