release.yml

# GitHub Actions workflow for version bumping and package publishing
# This workflow creates a new version tag, builds the package, and publishes it to PyPI

name: Build and publish

on:
  workflow_dispatch:  # Manual trigger only
    inputs:
      tag:
        description: 'Release tag (e.g. v1.2.3)'
        required: true
        type: string

jobs:
  build:
    #needs: tagging
    runs-on: ubuntu-latest
    permissions:
      contents: write  # Permission to write to repository contents (for creating releases)
    steps:
      # Step 1: Checkout the repository code
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v4

      # Step 2: Build the package
      - name: build
        run: |
          pip install --upgrade build
          python -m build

      # Step 3: Upload artifact
      - name: Upload build artifact
        uses: actions/upload-artifact@v4
        with:
          name: dist  # This must match the name used in download step
          path: dist/

  # Job to publish the built package to PyPI
  publish:
    needs: build  # This job depends on the tag job
    runs-on: ubuntu-latest
    environment: release  # Use the release environment

    permissions:
      contents: read  # Read-only access to repository contents

    steps:
      # Step 1: Download the built package artifact
      - uses: actions/download-artifact@v8
        with:
          name: dist  # Name of the artifact
          path: dist  # Path to download the artifact to

      # todo: change to id-token
      - name: publish
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}