publish-package.yml

name: publish distributions
on:
  push:
    branches:
    - main
    tags:
    - v*
  pull_request:
    branches:
    - main
    - release/v*
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      publish:
        type: choice
        description: 'Publish to TestPyPI?'
        options:
        - false
        - true

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    name: Build Python distribution
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      attestations: write

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.x'

    - name: Install dependencies
      run: |
        python -m pip install uv

    - name: Build a sdist and a wheel
      run: |
        pipx run build --installer uv .

    - name: Verify history available for dev versions
      run: |
        wheel_name=$(find dist/ -iname "*.whl" -printf "%f\n")
        if [[ "${wheel_name}" == *"pylhe-0.1.dev"* ]]; then
          echo "python-build incorrectly named built distribution: ${wheel_name}"
          echo "python-build is lacking the history and tags required to determine version number"
          echo "intentionally erroring with 'return 1' now"
          return 1
        fi
        echo "python-build named built distribution: ${wheel_name}"

    - name: Verify the distribution
      run: pipx run twine check --strict dist/*

    - name: List contents of sdist
      run: python -m tarfile --list dist/pylhe-*.tar.gz

    - name: List contents of wheel
      run: python -m zipfile --list dist/pylhe-*.whl

    - name: Generate artifact attestation for sdist and wheel
      # If publishing to TestPyPI or PyPI
      if: >-
        (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe')
        || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe')
        || (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe')
      uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
      with:
        subject-path: "dist/pylhe-*"

    - name: Upload distribution artifact
      uses: actions/upload-artifact@v4
      with:
        name: dist-artifact
        path: dist

  publish:
    name: Publish Python distribution to (Test)PyPI
    if: github.event_name != 'pull_request'
    needs: build
    runs-on: ubuntu-latest
    # Mandatory for publishing with a trusted publisher
    # c.f. https://docs.pypi.org/trusted-publishers/using-a-publisher/
    permissions:
      id-token: write
    # Restrict to the environment set for the trusted publisher
    environment:
      name: publish-package

    steps:
    - name: Download distribution artifact
      uses: actions/download-artifact@v4
      with:
        name: dist-artifact
        path: dist

    - name: List all files
      run: ls -lh dist

    - name: Verify sdist artifact attestation
      # If publishing to TestPyPI or PyPI
      if: >-
        (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe')
        || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe')
        || (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe')
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: gh attestation verify dist/pylhe-*.tar.gz --repo ${{ github.repository }}

    - name: Verify wheel artifact attestation
      # If publishing to TestPyPI or PyPI
      if: >-
        (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe')
        || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe')
        || (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe')
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: gh attestation verify dist/pylhe-*.whl --repo ${{ github.repository }}

    - name: Publish distribution 📦 to Test PyPI
      # Publish to TestPyPI on tag events of if manually triggered
      # Compare to 'true' string as booleans get turned into strings in the console
      if: >-
        (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe')
        || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe')
      uses: pypa/gh-action-pypi-publish@v1.12.3
      with:
        repository-url: https://test.pypi.org/legacy/
        print-hash: true
        attestations: true

    - name: Publish distribution 📦 to PyPI
      if: github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe'
      uses: pypa/gh-action-pypi-publish@v1.12.3
      with:
        print-hash: true
        attestations: true