pythonpublish.yml

name: Upload Python Package to Pypi

on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: write   # needed to create the GitHub release for the tag
      id-token: write   # needed for PyPI trusted publishing (OIDC)

    steps:
      - name: Validate tag format (X.Y.Z)
        shell: bash
        run: |
          TAG="${GITHUB_REF_NAME}"
          echo "Pushed tag: $TAG"
          if ! [[ "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Tag must be X.Y.Z (e.g. 1.2.3). Got: $TAG"
            exit 1
          fi

      - uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - name: Validate pyproject.toml version matches tag
        run: |
          python - <<'PY'
          import os, pathlib, tomllib

          tag = os.environ["GITHUB_REF_NAME"]
          data = tomllib.loads(pathlib.Path("pyproject.toml").read_text(encoding="utf-8"))
          py_ver = data["project"]["version"]

          print(f"pyproject.toml version: {py_ver}")
          if py_ver != tag:
              raise SystemExit(f"Version mismatch: tag={tag} but pyproject.toml={py_ver}")
          PY

      - name: Build distributions
        run: |
          python -m pip install --upgrade pip
          pip install build
          python -m build

      - name: Publish to PyPI (OIDC)
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist

      - name: Create GitHub release for tag
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${GITHUB_REF_NAME}"
          if gh release view "$TAG" >/dev/null 2>&1; then
            echo "Release $TAG already exists, skipping."
          else
            gh release create "$TAG" \
              --title "$TAG" \
              --generate-notes \
              dist/*
          fi