.github/workflows/publish.yml

# This workflow is triggered three ways:
#
# 1. Manually triggering the workflow via the GitHub UI (Actions > Upload
#    package) will upload to test.pypi.org without the need to create a tag.
# 2. When a tag is created, the workflow will upload the package to
#    test.pypi.org.
# 3. When a GitHub Release is made, the workflow will upload the package to pypi.org.
#
# It is done this way until PyPI has draft reviews, to allow for a two-stage
# upload with a chance for manual intervention before the final publication.
#
# Nothing is uploaded unless the validate workflow passes first, including
# installing the built sdist and wheel on every supported version of Python.
#
# Uploads use PyPI trusted publishing (OIDC), so no API tokens are stored as
# secrets. The trusted publisher on both PyPI and Test PyPI must be configured
# with workflow "publish.yml" and environment "release".
name: Upload package

on:
  release:
    types: [created]
  push:
    tags:
      - '*'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  # Run the full validation suite, including installing the sdist on every
  # supported Python. This builds the distributions that are uploaded below,
  # so the files that get published are exactly the files that were tested.
  validate:
    # Reusable workflows resolve at the caller's commit, not from the workspace.
    uses: ./.github/workflows/validate.yml # zizmor: ignore[self-repository]
    with:
      release: true

  publish:
    needs: validate
    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write  # Required for trusted publishing
    steps:
    - name: Download distributions
      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
      with:
        name: dist
        path: dist/
    - name: Publish package to Test PyPI
      if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
      uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
      with:
        repository-url: https://test.pypi.org/legacy/
    - name: Publish package to PyPI
      if: github.event_name == 'release'
      uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3