workflow.yml

name: Build & publish to PyPI

on:
  workflow_dispatch:
  pull_request:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+*"

jobs:
  build:
    name: Build package
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: 3.12

      - name: cache poetry install
        uses: actions/cache@v4
        with:
          path: ~/.local
          key: poetry-1.8.3-0

      - uses: snok/install-poetry@v1
        with:
          version: 1.8.3
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: cache deps
        id: cache-deps
        uses: actions/cache@v4
        with:
          path: .venv
          key: pydeps-${{ hashFiles('**/poetry.lock') }}

      - run: poetry install --no-interaction --no-root
        if: steps.cache-deps.outputs.cache-hit != 'true'

      - run: poetry install --no-interaction

      - run: poetry build

      - uses: actions/upload-artifact@v4
        with:
          path: dist

  publish:
    if: github.ref_type == 'tag'
    name: Publish to PyPI
    needs: [build]
    environment:
      name: PyPI
      url: https://pypi.org/p/nsidc-metgenc
    permissions:
      id-token: write
      attestations: write
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Generate artifact attestation for sdist and wheel
        uses: actions/attest-build-provenance@v1.4.3
        with:
          subject-path: "dist/*"

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1