python-publish.yml

# This workflow will upload a Python Package using Twine when a release is created
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: Publish to PyPI on GitHub Release

on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write   # needed for Trusted Publishing

jobs:
  build-and-publish:
    runs-on: ubuntu-latest
    environment: pypi
    # Only run from the canonical repo and for final tags like v1.2.3 (no pre-release hyphens)
    if: >
      github.repository == 'mmschlk/shapiq' &&
      startsWith(github.event.release.tag_name, 'v') &&
      !contains(github.event.release.tag_name, '-')

    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0
        ref: ${{ github.event.release.tag_name }}  # build exactly the released tag

    - name: Install uv and python
      uses: astral-sh/setup-uv@v7
      with:
          python-version: '3.12'

    - name: Build package
      run: uv build

    - name: Upload dist artifact
      uses: actions/upload-artifact@v6
      with:
        name: shapiq-${{ github.event.release.tag_name }}-dist
        path: dist/*

    - name: Publish to PyPI (Trusted Publishing)
      uses: pypa/gh-action-pypi-publish@v1.13.0
      with:
        attestations: true