build.yml

name: Build and Release Package

on: [ push, pull_request ]

jobs:

  dump-context:
    runs-on: ubuntu-latest
    steps:
      - name: Dump context "GitHub"
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
        run: echo "$GITHUB_CONTEXT"

  build-test:
    strategy:
      matrix:
        os: [ ubuntu-latest, macos-latest, windows-latest ]
    runs-on: ${{ matrix.os }}
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Check out the repository
        uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install hatch pre-commit coverage
          hatch env create
      - name: Lint and typecheck
        run: |
          hatch run lint:all
      - name: Run Tests with coverage analysis
        run: |
          hatch test --cover
      - uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true
          verbose: true

  build-distribution:
    runs-on: ubuntu-latest
    needs: build-test
    steps:
      - name: Check out the repository
        uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'
      - name: Install dependencies
        shell: bash
        run: |
          python -m pip install --upgrade pip
          pip install hatch pre-commit
      - name: Build with Hatch
        run: |
          hatch build
      - name: Upload distributions
        uses: actions/upload-artifact@v4
        with:
          name: python-package-distributions
          path: dist/

  publish-testpypi:
    runs-on: ubuntu-latest
    needs: build-distribution
    environment:
      name: pypi-test
      url: https://testpypi.org/project/p{{ github.event.repository.name }}
    permissions:
      id-token: write
    # if: startsWith(github.ref, 'refs/tags/')
    # if: startsWith(github.ref, 'refs/heads/main')
    steps:
      - name: Download all the dists
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions
          path: dist/
      - name: Publish 📦 to Test PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/
          repository-url: https://test.pypi.org/legacy/
          verbose: true
          # skip-existing: true
          # user: __token__
          # password: ${{ secrets.TEST_PYPI_SECRECT }}

  publish-pypi:
    runs-on: ubuntu-latest
    needs: [ build-distribution, publish-testpypi ]
    environment:
      name: pypi
      url: https://pypi.org/project/p{{ github.event.repository.name }}
    permissions:
      id-token: write
    # if: startsWith(github.ref, 'refs/tags/')
    # if: startsWith(github.ref, 'refs/heads/main')
    steps:
      - name: Download all the dists
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions
          path: dist/
      - name: Publish 📦 to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/
          # repository-url = "https://upload.pypi.org/legacy/"
          verbose: true
          # user: __token__
          # password: ${{ secrets.PYPI_SECRECT }}

  github-release:
    runs-on: ubuntu-latest
    needs: publish-pypi
    permissions:
      contents: write  # IMPORTANT: mandatory for making GitHub Releases
      id-token: write  # IMPORTANT: mandatory for sigstore
    steps:
      - name: Download all the dists
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions
          path: dist/
      - name: Sign the Python 🐍 distribution 📦 with Sigstore
        uses: sigstore/gh-action-sigstore-python@v3.0.0
        with:
          inputs: >-
            ./dist/*.tar.gz
            ./dist/*.whl
      - name: Create GitHub Release
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: >-
          gh release create
          '${{ github.ref_name }}'
          --repo '${{ github.repository }}'
          --notes ""
      - name: Upload artifact signatures to GitHub Release
        env:
          GITHUB_TOKEN: ${{ github.token }}
        # Upload to GitHub Release using the `gh` CLI.
        # `dist/` contains the built packages, and the
        # sigstore-produced signatures and certificates.
        run: >-
          gh release upload
          '${{ github.ref_name }}' dist/**
          --repo '${{ github.repository }}'