python-publish.yml

name: Python Publish

on:
  release:
    types: [published]

jobs:
  guard:
    name: Check tag belongs to Python
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      publish: ${{ steps.guard.outputs.publish }}
      version: ${{ steps.guard.outputs.version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Validate tag format
        id: guard
        run: bash .github/scripts/tag-guard.sh python "$GITHUB_REF_NAME"

  publish:
    name: Publish
    needs: guard
    if: needs.guard.outputs.publish == 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: python

    permissions:
      contents: write # Required to upload release artifacts
      id-token: write # Enable GitHub OIDC token issuance for PyPI Trusted Publishing

    env:
      VERSION: ${{ needs.guard.outputs.version }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Poetry
        run: |
          pip install poetry

      - name: Set version from tag
        run: |
          echo "Setting poetry version to $VERSION"
          poetry version "$VERSION"

      - name: Install dependencies
        run: poetry install --no-root

      - name: Build package
        run: poetry build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: python/dist

      - name: Upload dist artifacts to GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            python/dist/*.whl