release.yml

name: Release

# PyPI trusted publishing: no API token lives in CI, ever. Configure the trusted publisher on
# PyPI's project settings page with: owner foretop-dev, repository ebb, workflow release.yml,
# environment pypi. Triggered by publishing a GitHub Release (a deliberate human action), not
# by every tag push.

on:
  release:
    types: [published]

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: read
      id-token: write # mandatory for PyPI trusted publishing
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v9.0.0
      - run: uv build -o dist
      - run: uv venv .wheel-test
      - run: uv pip install --python .wheel-test/bin/python dist/*.whl
      - run: python scripts/check_ebb_distribution.py --python .wheel-test/bin/python
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist