Merge pull request #1110 from bids-standard/test-pypi-uploads

chore(ci): Upload attested package to (test) PyPI

.github/workflows/test.yml → .github/workflows/build-test-deploy.yml

@@ -1,5 +1,3 @@
-name: Python tests
-
 # This file tests the claimed support range of PyBIDS including
 #
 # * Operating systems: Linux, OSX
@@ -9,6 +7,9 @@ on:
     branches:
       - master
       - maint/*
+      - test-pypi-uploads
+    tags:
+      - '*'
   pull_request: {}
   schedule:
     # 8am EST / 9am EDT Mondays
@@ -112,3 +113,44 @@ jobs:
         with:
           files: cov.xml
           token: ${{ secrets.CODECOV_TOKEN }}
+
+  test-publish:
+    name: Push package to test.pypi.org
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    needs: [build]
+    permissions:
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+
+      - name: Upload package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+
+  publish:
+    name: Publish released package to pypi.org
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+    runs-on: ubuntu-latest
+    needs: [test, test-publish]
+    permissions:
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+
+      - name: Upload package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1