ci: Update release.yml

Continues to fail when every time the main branch is built because the testpypi upload doesn't have different filenames. Rather than try to create unique filenames (and potentially create a huge pypi entry) this adds a guard to stop pypi and testpypi unless it is a tag.


Signed-off-by: David Hart <[email protected]>

.github/workflows/release.yml

@@ -58,11 +58,40 @@ jobs:
         name: cibw-sdist
         path: dist/*.tar.gz
 
+  publish-to-testpypi:
+    name: Publish Python 🐍 distribution 📦 to TestPyPI
+    needs: [build_wheels, make_sdist]
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.ref, 'refs/tags/') && github.repository == 'sandialabs/sansmic' }}  # only publish to PyPI on tag pushes
+
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/sansmic
+
+    permissions:
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
+
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      with:
+        pattern: cibw-*
+        path: dist
+        merge-multiple: true
+    - name: Publish distribution 📦 to TestPyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        skip-existing: true
+        print-hash: true
+        verbose: true
+        attestations: true
+        repository-url: https://test.pypi.org/legacy/
+
   publish-to-pypi:
     name: >-
       Publish Python 🐍 distribution 📦 to PyPI
     if: ${{ startsWith(github.ref, 'refs/tags/') && github.repository == 'sandialabs/sansmic' }}  # only publish to PyPI on tag pushes
-    needs: [build_wheels, make_sdist]
+    needs: [publish-to-testpypi]
     environment:
       name: release
       url: https://pypi.org/p/sansmic
@@ -83,6 +112,9 @@ jobs:
         merge-multiple: true
     - name: Publish distribution 📦 to PyPI
       uses: pypa/gh-action-pypi-publish@897895f1e160c830e369f9779632ebc134688e1b # release/v1
+      with: 
+        attestations: true
+        print-hash: true
 
   github-release:
     name: >-
@@ -127,31 +159,3 @@ jobs:
         gh release upload
         '${{ github.ref_name }}' dist/**
         --repo '${{ github.repository }}'
-
-  publish-to-testpypi:
-    name: Publish Python 🐍 distribution 📦 to TestPyPI
-    needs: [build_wheels, make_sdist]
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'sandialabs/sansmic' }}
-
-    environment:
-      name: testpypi
-      url: https://test.pypi.org/p/sansmic
-
-    permissions:
-      id-token: write  # IMPORTANT: mandatory for trusted publishing
-
-    steps:
-    - name: Download all the dists
-      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-      with:
-        pattern: cibw-*
-        path: dist
-        merge-multiple: true
-    - name: Publish distribution 📦 to TestPyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        skip-existing: true
-        print-hash: true
-        verbose: true
-        repository-url: https://test.pypi.org/legacy/