release.yml

name: Release

on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  publish:
    if: github.event.release.target_commitish == 'main'
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.release.tag_name }}
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - run: pip install -e ".[test]"
      - name: Verify release version and branch
        env:
          RELEASE_NAME: ${{ github.event.release.name }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          python -c 'import os, sys, tomllib; version = tomllib.load(open("pyproject.toml", "rb"))["project"]["version"]; expected = os.environ["RELEASE_TAG"]; sys.exit(f"release tag {expected!r} does not match package version {version!r}" if expected != version else 0)'
          test "$RELEASE_NAME" = "$RELEASE_TAG"
          git fetch origin main
          release_commit="$(git rev-list -n 1 "$RELEASE_TAG")"
          git merge-base --is-ancestor "$release_commit" origin/main
      - run: python -m build
      - run: twine check dist/*
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
        with:
          packages-dir: dist/