publish.yml

name: Publish

on:
  push:
    branches:
      - main

jobs:
  pypi-publish:
    name: Upload release to PyPI
    runs-on: ubuntu-latest
    if: "contains(github.event.head_commit.message, 'Update CHANGELOG.md')"
    environment:
      name: pypi
      url: https://pypi.org/p/${{ vars.PACKAGE_NAME }}
    permissions:
      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
    steps:
      # Checkout the code
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0

      # Set up Python
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ vars.PYTHON_VERSION }}

      # Install dependencies
      - name: Install dependencies
        run: |
          pip install --upgrade pip
          pip install -r requirements.txt
          pip install -r test-requirements.txt

      # Verify the version
      - name: Verify version
        run: hatch version

      # Build packages
      - name: Build package distributions
        run: |
          python -m build

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: $${{ secrets.PYPI_PUBLISH_TOKEN }}