release.yml

name: Release

on:
  push:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - uses: hynek/build-and-inspect-python-package@v2

  publish:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    needs: [build]
    environment:
      name: publishing
      url: https://pypi.org/p/singer-sdk
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write  # Needed for OIDC PyPI publishing
    steps:
    - uses: actions/download-artifact@v4
      with:
        name: Packages
        path: dist
    - name: Publish
      uses: pypa/gh-action-pypi-publish@v1.9.0

  upload-to-release:
    name: Upload files to release
    runs-on: ubuntu-latest
    needs: [build]
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write     # Needed for uploading files to the release
      id-token: write     # Needed for attestations
      attestations: write # Needed for attestations

    steps:
    - uses: actions/download-artifact@v4
      with:
        name: Packages
        path: dist
    - name: Upload wheel and sdist to release
      uses: svenstaro/upload-release-action@v2
      with:
        file: dist/singer_sdk*
        tag: ${{ github.ref }}
        overwrite: true
        file_glob: true
    - uses: actions/attest-build-provenance@v1
      id: attest
      with:
        subject-path: "./dist/singer_sdk*"
    - name: Upload attestations to release
      uses: svenstaro/upload-release-action@v2
      with:
        file: ${{ steps.attest.outputs.bundle-path }}
        tag: ${{ github.ref }}
        overwrite: true
        asset_name: attestations.intoto.jsonl