python-publish.yml

name: Python Publish

on:
  workflow_dispatch: # for debug
  push:
    branches: [main]
    tags:
      - v*.*.*

permissions: read-all

jobs:
  release:
    runs-on: ubuntu-latest
    if: ${{ github.ref_name != 'main' }}
    permissions:
      contents: write
      packages: write
      id-token: write
      attestations: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Setup python environment
        uses: ./.github/actions/python-setup

      - name: Build package
        id: build
        run: |
          poetry run seman sbom
          poetry build
          echo "package_tar=`ls dist/ | grep .tar.gz`" >> $GITHUB_OUTPUT
          echo "package_whl=`ls dist/ | grep .whl`" >> $GITHUB_OUTPUT

      - name: Upload package to artifact
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
        with:
          name: package
          path: dist/

      - name: Upload package to release asset
        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          generate_release_notes: true
          files: |
            dist/${{ steps.build.outputs.package_tar }}
            dist/${{ steps.build.outputs.package_whl }}

      - name: Upload package to pypi
        uses: pypa/gh-action-pypi-publish@67339c736fd9354cd4f8cb0b744f2b82a74b5c70
        with:
          user: __token__
          password: ${{ secrets.PYPI_API_TOKEN }}

      - name: attest build provenance
        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb
        with:
          subject-path: |
            dist/${{ steps.build.outputs.package_tar }}
            dist/${{ steps.build.outputs.package_whl }}