From d872ad16121162cdb90b0fa56af73eaef2167127 Mon Sep 17 00:00:00 2001
From: David Hart <dbhart@users.noreply.github.com>
Date: Wed, 2 Oct 2024 15:03:59 -0600
Subject: [PATCH] ci: Update release.yml

Continues to fail when every time the main branch is built because the testpypi upload doesn't have different filenames. Rather than try to create unique filenames (and potentially create a huge pypi entry) this adds a guard to stop pypi and testpypi unless it is a tag.


Signed-off-by: David Hart <dbhart@users.noreply.github.com>
---
 .github/workflows/release.yml | 62 +++++++++++++++++++----------------
 1 file changed, 33 insertions(+), 29 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index be78449..d517a51 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -58,11 +58,40 @@ jobs:
         name: cibw-sdist
         path: dist/*.tar.gz
 
+  publish-to-testpypi:
+    name: Publish Python 🐍 distribution 📦 to TestPyPI
+    needs: [build_wheels, make_sdist]
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.ref, 'refs/tags/') && github.repository == 'sandialabs/sansmic' }}  # only publish to PyPI on tag pushes
+
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/sansmic
+
+    permissions:
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
+
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      with:
+        pattern: cibw-*
+        path: dist
+        merge-multiple: true
+    - name: Publish distribution 📦 to TestPyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        skip-existing: true
+        print-hash: true
+        verbose: true
+        attestations: true
+        repository-url: https://test.pypi.org/legacy/
+
   publish-to-pypi:
     name: >-
       Publish Python 🐍 distribution 📦 to PyPI
     if: ${{ startsWith(github.ref, 'refs/tags/') && github.repository == 'sandialabs/sansmic' }}  # only publish to PyPI on tag pushes
-    needs: [build_wheels, make_sdist]
+    needs: [publish-to-testpypi]
     environment:
       name: release
       url: https://pypi.org/p/sansmic
@@ -83,6 +112,9 @@ jobs:
         merge-multiple: true
     - name: Publish distribution 📦 to PyPI
       uses: pypa/gh-action-pypi-publish@897895f1e160c830e369f9779632ebc134688e1b # release/v1
+      with: 
+        attestations: true
+        print-hash: true
 
   github-release:
     name: >-
@@ -127,31 +159,3 @@ jobs:
         gh release upload
         '${{ github.ref_name }}' dist/**
         --repo '${{ github.repository }}'
-
-  publish-to-testpypi:
-    name: Publish Python 🐍 distribution 📦 to TestPyPI
-    needs: [build_wheels, make_sdist]
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'sandialabs/sansmic' }}
-
-    environment:
-      name: testpypi
-      url: https://test.pypi.org/p/sansmic
-
-    permissions:
-      id-token: write  # IMPORTANT: mandatory for trusted publishing
-
-    steps:
-    - name: Download all the dists
-      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-      with:
-        pattern: cibw-*
-        path: dist
-        merge-multiple: true
-    - name: Publish distribution 📦 to TestPyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        skip-existing: true
-        print-hash: true
-        verbose: true
-        repository-url: https://test.pypi.org/legacy/