name: Release

on:
  push:
    tags:
      - "[0-9]+.[0-9]+.[0-9]+"
    branches:
      - main

permissions:
  contents: read

jobs:
  packages:
    permissions:
      attestations: write
      id-token: write
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - run: pip install build==1.2.1

      - run: python -m build

      - name: generate build provenance
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: "${{ github.workspace }}/dist/*"

      - name: Upload Packages
        uses: actions/upload-artifact@v6
        with:
          name: packages
          path: |
            dist/*.whl
            dist/*tar.gz

  publish-pypi:
    needs:
      - packages
    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
    steps:
      - uses: actions/download-artifact@v7
        with:
          name: packages
          path: dist

      - name: Upload pypi.org
        if: startsWith(github.ref, 'refs/tags')
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
        with:
          repository-url: https://upload.pypi.org/legacy/
