release.yaml

---
name: release

on:
  push:
    branches: [main]
    tags: ["*"]

  release:
    types: [published]

  workflow_dispatch:

permissions:
  attestations: write
  contents: read
  id-token: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: setup ssh
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.YAAK_IDL_REPO_SSH_KEY }}

      - name: checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          persist-credentials: false
          fetch-depth: 0

      - name: build and inspect
        uses: hynek/build-and-inspect-python-package@v2.9.0
        with:
          attest-build-provenance-github: "true"

  release:
    environment: release
    if: github.event.action == 'published'
    runs-on: ubuntu-latest
    needs: build

    steps:
      - uses: actions/download-artifact@v4
        with:
          name: Packages
          path: dist

      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          attestations: true