publish-pypi.yml

name: Publish to PyPI
on:
  release:
    types: [published]
  push:
    branches:
      - main
jobs:
  # setup build separate from publish
  # See https://github.com/pypa/gh-action-pypi-publish/issues/217#issuecomment-1965727093
  build:
    runs-on: ubuntu-latest
    # This ensures that the publish action only runs in the main repository
    # rather than forks
    # Environment is encouraged so adding
    environment: build
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # This fetch element is only important if you are use SCM based
          # versioning (that looks at git tags to gather the version)
          fetch-depth: 100

      # Need the tags so that setuptools-scm can form a valid version number
      - name: Fetch git tags
        run: git fetch origin 'refs/tags/*:refs/tags/*'

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Install Hatch
        run: |
          pipx install hatch
          pip list

      - name: Build package using Hatch
        run: |
          hatch build
          echo ""
          echo "Generated files:"
          ls -lh dist/
      # Store an artifact of the build to use in the publish step below
      - name: Store the distribution packages
        uses: actions/upload-artifact@v4
        with:
          name: python-package-distributions
          path: dist/
  publish:
    name: >-
      Publish Python 🐍 distribution 📦 to PyPI
    if: github.repository_owner == 'pyopensci'
    needs:
      - build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/pyosmeta
    permissions:
      id-token: write  # this permission is mandatory for pypi publishing
    steps:
      # Version 4 doesn't support github enterprise yet
      - name: Download all the dists
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions
          path: dist/
      - name: Publish package to PyPI
        # Only publish to real PyPI on release
        if: github.event_name == 'release'
        uses: pypa/gh-action-pypi-publish@release/v1
  sign-files:
    name: >-
      Sign the Python 🐍 distribution 📦 with Sigstore
      and upload them to GitHub Release
    # Only sign on release
    if: github.repository_owner == 'pyopensci' && github.event_name == 'release'
    needs:
    - publish
    runs-on: ubuntu-latest
    permissions:
      contents: write  # this permission is mandatory for modifying GitHub Releases
      id-token: write  # this permission is mandatory for sigstore
    steps:
    - name: Download all the dists
      uses: actions/download-artifact@v4
      with:
        name: python-package-distributions
        path: dist/
    - name: Sign the dists with Sigstore
      uses: sigstore/gh-action-sigstore-python@v2.1.1
      with:
        inputs: >-
          ./dist/*.tar.gz
          ./dist/*.whl
    - name: Upload artifact signatures to GitHub Release
      env:
        GITHUB_TOKEN: ${{ github.token }}
      # Upload to GitHub Release using the `gh` CLI.
      # `dist/` contains the built packages, and the
      # sigstore-produced signatures and certificates.
      run: >-
        gh release upload
        '${{ github.ref_name }}' dist/**
        --repo '${{ github.repository }}'