python-publish.yml

---
name: Publish to PyPI

on: # yamllint disable rule:truthy
  push:
    tags: ["v*"]

permissions:
  attestations: write
  contents: write
  id-token: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: hynek/build-and-inspect-python-package@v2
        with:
          attest-build-provenance-github: "true"

  pypi-publish:
    name: upload release to PyPI
    runs-on: ubuntu-latest
    needs: build
    environment: pypi
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: Packages
          path: dist
      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
      - name: Create GitHub Release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ github.ref }}
          release_name: ${{ github.ref }}
          body: Release ${{ github.ref }}