python-publish.yml

# Publishes the package to PyPI when a GitHub Release is published.
#
# Authentication uses PyPI Trusted Publishers (OIDC) — there is no stored
# API token. The exchange is performed automatically by the publish action
# using the workflow's short-lived OIDC identity. For this to work, a Trusted
# Publisher must be configured on PyPI for this repository, naming this
# workflow file (python-publish.yml) and the `pypi` environment.
# See: https://docs.pypi.org/trusted-publishers/

name: Upload Python Package

on:
  release:
    types: [published]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/actinia-openapi-python-client
    permissions:
      id-token: write        # REQUIRED for OIDC trusted publishing
    steps:
      - uses: actions/checkout@v7
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.x'
      - name: Build package
        run: |
          python -m pip install --upgrade pip build
          python -m build
      - name: Publish package to PyPI
        # Pinned to a release tag; OIDC means no user/password is supplied.
        uses: pypa/gh-action-pypi-publish@release/v1