release_publish.yml

name: "Release: Publish"
run-name: "Release: ${{ github.event.head_commit.message }}"

on:
  push:
    branches:
      - mainline
    paths:
      - CHANGELOG.md

concurrency:
  group: release

jobs:
  Publish:
    name: Publish Release
    permissions:
      id-token: write
      contents: write
    uses: OpenJobDescription/.github/.github/workflows/reusable_publish.yml@mainline
    secrets: inherit
  # PyPI does not support reusable workflows yet
  # # See https://github.com/pypi/warehouse/issues/11096
  PublishToPyPI:
    needs: Publish
    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: release
          fetch-depth: 0
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.9'
      - name: Install dependencies
        run: |
          pip install --upgrade hatch
      - name: Build
        run: hatch -v build
      # # See https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-pypi
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1