CI: Condition upload attempt on presence of token

Author: effigies

.github/workflows/pythonpackage.yml

@@ -80,8 +80,18 @@ jobs:
       with:
         name: distributions
         path: dist/
-    - name: Upload to PyPI (on tags)
+    # Deploy on tags if PYPI_API_TOKEN is defined in the repository secrets.
+    # Secrets are not accessible in the if: condition [0], so set an output variable [1]
+    # [0] https://github.community/t/16928
+    # [1] https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#setting-an-output-parameter
+    - name: Check for PyPI token on tag
+      id: deployable
       if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+      env:
+        PYPI_API_TOKEN: "${{ secrets.PYPI_API_TOKEN }}"
+      run: if [ -n "$PYPI_API_TOKEN" ]; then echo ::set-output name=DEPLOY::true; fi
+    - name: Upload to PyPI
+      if: steps.deployable.outputs.DEPLOY
       uses: pypa/gh-action-pypi-publish@master
       with:
         user: __token__

README.md

@@ -35,7 +35,10 @@ python setup.py sdist bdist_wheel
 twine upload dist/*
 ```
 
-Note that we assume tags will be version numbers and not be prefixed with `v` or some other
+Note that uploading to PyPI is done via [Continuous integration](#continuous-integration)) when
+a tag is pushed to the repository, so only the first step needs to be donne manually.
+
+Note also that we assume tags will be version numbers and not be prefixed with `v` or some other
 string. See Versioneer documentation for alternative configurations.
 
 ## Namespace packages
@@ -72,6 +75,10 @@ non-compliant package can potentially affect Pydra or other task packages.
 In addition to verifying installations do not break or conflict, pytest is run on the package,
 including all tests found in `test/` directories and [doctests].
 
+Finally, packages are built and uploaded as artifacts for inspection. When a tag is pushed,
+the packages are uploaded to PyPI if a valid [API token](https://pypi.org/help/#apitoken) is placed
+in the [repository secrets](https://docs.github.com/en/actions/reference/encrypted-secrets).
+
 [doctests]: https://docs.python.org/3/library/doctest.html
 
 # Contributing to this template