publish.yml

name: Publish

on:
  push:
    tags: ['v[0-9]+.[0-9]+.[0-9]+']

jobs:
  build:
    name: Build distributions
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/setup-python@v7
        with:
          python-version: '3.12'

      - name: Tag must match pyproject.toml
        run: |
          tag="${GITHUB_REF_NAME#v}"
          ver="$(python -c 'import tomllib,pathlib; print(tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"])')"
          [ "$tag" = "$ver" ] || { echo "tag $tag != pyproject $ver"; exit 1; }

      - run: pip install -e ".[dev]" build
      # The suite stubs the transport, so it needs no API key and makes no network calls.
      - run: pytest -q
      - run: ruff check .
      - run: mypy src
      - run: python -m build # hatchling; writes sdist + wheel to dist/

      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/
          if-no-files-found: error

  publish:
    name: Publish to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write # mandatory for trusted publishing; nothing else is needed
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/

      # No username, no password, no PYPI_API_TOKEN — the publisher is registered on PyPI
      # against this repo, this workflow filename and the `pypi` environment above. PEP 740
      # attestations are generated and uploaded automatically. The job holding id-token
      # deliberately runs no project code of its own.
      - uses: pypa/gh-action-pypi-publish@release/v1