publish.yml

name: Publish package to PyPI

on:
  release:
    types: [created]
  workflow_dispatch: # run manually from actions tab

# Set permissions at the job level.
permissions: {}

jobs:
  build:
    name: Build the package
    # disables this workflow from running in a repository that is not part of the indicated organization/user
    if: github.repository_owner == 'afuetterer'
    runs-on: ubuntu-24.04
    permissions:
      attestations: write
      id-token: write
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - uses: hynek/build-and-inspect-python-package@f01e4d047aadcc0c054c95ec9900da3ec3fc7a0f # v2.10.0
      with:
        attest-build-provenance-github: 'true'
  upload:
    name: Upload package distributions to GitHub Releases
    # disables this workflow from running in a repository that is not part of the indicated organization/user
    if: github.repository_owner == 'afuetterer'
    runs-on: ubuntu-24.04
    needs: build
    permissions:
      contents: write
    steps:
    - name: Download package built by build job
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      with:
        name: Packages
        path: dist
    - name: Publish package distributions to GitHub Releases
      uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2.0.9
      with:
        files: dist/*
  publish:
    # disables this workflow from running in a repository that is not part of the indicated organization/user
    if: github.repository_owner == 'afuetterer'
    runs-on: ubuntu-24.04
    needs: build
    environment: publish
    permissions:
      id-token: write
    steps:
    - name: Download package built by build job
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      with:
        name: Packages
        path: dist
    - name: Publish package to PyPI
      uses: pypa/gh-action-pypi-publish@15c56dba361d8335944d31a2ecd17d700fc7bcbc # v1.12.2
  docker:
    name: Publish Docker image to ghcr.io
    # disables this workflow from running in a repository that is not part of the indicated organization/user
    if: github.repository_owner == 'afuetterer'
    runs-on: ubuntu-24.04
    needs: build
    permissions:
      contents: read
      packages: write
    env:
      IMAGE_NAME: ${{ github.repository }}
    steps:
    - uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
    - name: Login to GitHub Container Registry
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Generate Docker image metadata
      id: meta
      # Ref: https://github.com/docker/metadata-action?tab=readme-ov-file#customizing
      uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
      with:
        images: ghcr.io/${{ env.IMAGE_NAME }}
        flavor: latest=true
        tags: |
          type=pep440,pattern={{version}}
          type=pep440,pattern={{major}}.{{minor}}
    - name: Build and push image to registry
      # Ref: https://github.com/docker/build-push-action?tab=readme-ov-file#customizing
      uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
      with:
        push: true
        build-args: VERSION=${{ github.event.release.name }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        # Ref: https://docs.docker.com/build/attestations/slsa-provenance/
        provenance: false