release.yml

name: release

on:
  workflow_dispatch:
  push:
    branches:
      - main

jobs:
  # job to determine appropriate version number, update changelog, and create a release commit
  release:
    runs-on: ubuntu-latest
    concurrency: release
    permissions:
      id-token: write
      contents: write

    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
          token: ${{secrets.PAT}}

      - name: Python Semantic Release
        id: release
        uses: python-semantic-release/python-semantic-release@master

      # Always build & lint package.
      - name: Build & verify package
        id: build-package
        uses: hynek/build-and-inspect-python-package@v1

      # Upload to Test PyPI on every commit on main.
      - name: Publish in-dev package to test.pypi.org
        id: release-test-pypi
        needs: [release, build-package]
        environment:
          name: testpypi
          url: https://pypi.org/p/invert4geom
        permissions:
          id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
        if: github.ref == 'refs/heads/main'

      # Download the built package from the build-package job.
      - name: Download packages built by build-and-inspect-python-package
        uses: actions/download-artifact@v3
        with:
          name: Packages
          path: dist

      # Upload to Test PyPI
      - name: Upload package to Test PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        environment:
          name: testpypi
        permissions:
          id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
        with:
          repository-url: https://test.pypi.org/legacy/

      # Upload to real PyPI on GitHub Releases.
      - name: Publish released package to pypi.org
        id: release-pypi
        needs: [release, build-package]
        environment:
          name: pypi
          url: https://pypi.org/p/invert4geom
        permissions:
          id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
        if: github.ref == 'refs/heads/main'
        uses: pypa/gh-action-pypi-publish@release/v1

      # Upload to GitHub Releases.
      - name: Publish package distributions to GitHub Releases
        id: release-github
        uses: python-semantic-release/upload-to-gh-release@main
        # if: ${{ always() && contains(join(needs.*.result, ','), 'success') }}
        if: steps.release.outputs.released == 'true'
        needs: [release, build-package]