python-publish.yml

name: Python Publish

on:
  workflow_dispatch: # for debug
  push:
    branches: [main]
    tags:
      - v*.*.*

permissions: read-all

jobs:
  release:
    runs-on: ubuntu-latest
    if: ${{ github.ref_name != 'main' }}
    permissions:
      contents: write
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Setup python environment
        uses: ./.github/actions/python-setup

      - name: Build package
        id: build
        run: |
          poetry run seman sbom
          poetry build
          echo "package_tar=`ls dist/ | grep .tar.gz`" >> $GITHUB_OUTPUT
          echo "package_whl=`ls dist/ | grep .whl`" >> $GITHUB_OUTPUT

      - name: Upload package to artifact
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
        with:
          name: package
          path: dist/

      - name: Upload package to release asset
        uses: softprops/action-gh-release@3198ee18f814cdf787321b4a32a26ddbf37acc52
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          generate_release_notes: true
          files: |
            dist/${{ steps.build.outputs.package_tar }}
            dist/${{ steps.build.outputs.package_whl }}

      - name: Upload package to pypi
        uses: pypa/gh-action-pypi-publish@81e9d935c883d0b210363ab89cf05f3894778450
        with:
          user: __token__
          password: ${{ secrets.PYPI_API_TOKEN }}