publish.yml

name: Publish to PyPI

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: release
    env:
      PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Verify tag matches package version
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PACKAGE_VERSION="$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")"
          if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
            echo "Tag version ($TAG_VERSION) does not match package version ($PACKAGE_VERSION)."
            exit 1
          fi

      - name: Build distributions
        run: |
          python -m pip install -U pip build
          python -m build

      - name: Publish to PyPI (API token)
        if: env.PYPI_API_TOKEN != ''
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ env.PYPI_API_TOKEN }}

      - name: Publish to PyPI (trusted publisher)
        if: env.PYPI_API_TOKEN == ''
        uses: pypa/gh-action-pypi-publish@release/v1