ci-cd.yml

---

name: 🧪

on:
  merge_group:
  push:  # publishes to TestPyPI pushes to the main branch
    branches-ignore:
    - dependabot/**  # Dependabot always creates PRs
    - gh-readonly-queue/**  # Temporary merge queue-related GH-made branches
    - maintenance/pip-tools-constraint-lockfiles  # Lock files through PRs
    - maintenance/pip-tools-constraint-lockfiles-**  # Lock files through PRs
    - patchback/backports/**  # Patchback always creates PRs
    - pre-commit-ci-update-config  # pre-commit.ci always creates a PR
  pull_request:
    ignore-paths:  # changes to the cron workflow are triggered through it
    - .github/workflows/scheduled-runs.yml
    types:
    - opened  # default
    - synchronize  # default
    - reopened  # default
    - ready_for_review  # used in PRs created from the release workflow
  workflow_call:  # a way to embed the main tests
  workflow_dispatch:
    inputs:
      release-version:
        # github.event_name == 'workflow_dispatch'
        # && github.event.inputs.release-version
        description: >-
          Target PEP440-compliant version to release.
          Please, don't prepend `v`.
        required: true
        type: string
      release-committish:
        # github.event_name == 'workflow_dispatch'
        # && github.event.inputs.release-committish
        default: ''
        description: >-
          The commit to be released to PyPI and tagged
          in Git as `release-version`. Normally, you
          should keep this empty.
        type: string
      YOLO:
        default: false
        description: >-
          Set this flag to disregard the outcome of the
          test stage. The test results will block the
          release otherwise. Only use this under
          extraordinary circumstances to ignore the test
          failures and cut the release regardless.
        type: boolean

concurrency:
  group: >-
    ${{
        github.workflow
    }}-${{
        github.ref_type
    }}-${{
        github.event.pull_request.number || github.sha
    }}
  cancel-in-progress: true

env:
  FORCE_COLOR: 1  # Request colored output from CLI tools supporting it
  MYPY_FORCE_COLOR: 1  # MyPy's color enforcement
  PIP_DISABLE_PIP_VERSION_CHECK: 1  # Hide "there's a newer pip" message
  PIP_NO_PYTHON_VERSION_WARNING: 1  # Hide "this Python is deprecated" message
  PIP_NO_WARN_SCRIPT_LOCATION: 1  # Hide "script dir is not in $PATH" message
  PRE_COMMIT_COLOR: always
  PROJECT_NAME: sphinxcontrib-towncrier
  PUBLISHING_TO_TESTPYPI_ENABLED: true
  PY_COLORS: 1  # Recognized by the `py` package, dependency of `pytest`
  PYTHONIOENCODING: utf-8
  PYTHONUTF8: 1
  TOX_PARALLEL_NO_SPINNER: 1  # Disable tox's parallel run spinner animation
  TOX_TESTENV_PASSENV: >-  # Make tox-wrapped tools see color requests
    FORCE_COLOR
    MYPY_FORCE_COLOR
    NO_COLOR
    PIP_DISABLE_PIP_VERSION_CHECK
    PIP_NO_PYTHON_VERSION_WARNING
    PIP_NO_WARN_SCRIPT_LOCATION
    PRE_COMMIT_COLOR
    PY_COLORS
    PYTEST_THEME
    PYTEST_THEME_MODE
    PYTHONIOENCODING
    PYTHONLEGACYWINDOWSSTDIO
    PYTHONUTF8
  UPSTREAM_REPOSITORY_ID: >-
    284275487

run-name: >-
  ${{
    github.event_name == 'workflow_dispatch'
    && format('📦 Releasing v{0}...', github.event.inputs.release-version)
    || ''
  }}
  ${{
      github.event.pull_request.number && '🔀 PR' || ''
  }}${{
      !github.event.pull_request.number && '🌱 Commit' || ''
  }}
  ${{ github.event.pull_request.number || github.sha }}
  triggered by: ${{ github.event_name }} of ${{
    github.ref
  }} ${{
    github.ref_type
  }}
  (workflow run ID: ${{
    github.run_id
  }}; number: ${{
    github.run_number
  }}; attempt: ${{
    github.run_attempt
  }})

jobs:
  pre-setup:
    name: ⚙️ Pre-set global build settings

    runs-on: ubuntu-latest

    timeout-minutes: 1

    defaults:
      run:
        shell: python

    outputs:
      # NOTE: These aren't env vars because the `${{ env }}` context is
      # NOTE: inaccessible when passing inputs to reusable workflows.
      dists-artifact-name: python-package-distributions
      dist-version: >-
        ${{
            steps.request-check.outputs.release-requested == 'true'
            && github.event.inputs.release-version
            || steps.scm-version.outputs.dist-version
        }}
      is-untagged-devel: >-
        ${{ steps.untagged-check.outputs.is-untagged-devel || false }}
      release-requested: >-
        ${{
            steps.request-check.outputs.release-requested || false
        }}
      is-yolo-mode: >-
        ${{
          (
            steps.request-check.outputs.release-requested == 'true'
            && github.event.inputs.YOLO
          )
          && true || false
        }}
      cache-key-for-dep-files: >-
        ${{ steps.calc-cache-key-files.outputs.cache-key-for-dep-files }}
      git-tag: ${{ steps.git-tag.outputs.tag }}
      sdist-artifact-name: ${{ steps.artifact-name.outputs.sdist }}
      wheel-artifact-name: ${{ steps.artifact-name.outputs.wheel }}
      upstream-repository-id: ${{ env.UPSTREAM_REPOSITORY_ID }}
      publishing-to-testpypi-enabled: ${{ env.PUBLISHING_TO_TESTPYPI_ENABLED }}

    steps:
    - name: Switch to using Python 3.11 by default
      uses: actions/setup-python@v5
      with:
        python-version: 3.11
    - name: >-
        Mark the build as untagged '${{
            github.event.repository.default_branch
        }}' branch build
      id: untagged-check
      if: >-
        github.event_name == 'push' &&
        github.ref == format(
          'refs/heads/{0}', github.event.repository.default_branch
        )
      run: |
        from os import environ
        from pathlib import Path

        FILE_APPEND_MODE = 'a'

        with Path(environ['GITHUB_OUTPUT']).open(
                mode=FILE_APPEND_MODE,
        ) as outputs_file:
            print('is-untagged-devel=true', file=outputs_file)
    - name: Mark the build as "release request"
      id: request-check
      if: github.event_name == 'workflow_dispatch'
      run: |
        from os import environ
        from pathlib import Path

        FILE_APPEND_MODE = 'a'

        with Path(environ['GITHUB_OUTPUT']).open(
                mode=FILE_APPEND_MODE,
        ) as outputs_file:
            print('release-requested=true', file=outputs_file)
    - name: Check out src from Git
      uses: actions/checkout@v4
      with:
        fetch-depth: >-
          ${{
              steps.request-check.outputs.release-requested == 'true'
              && 1
              || 0
          }}
        ref: ${{ github.event.inputs.release-committish }}
    - name: >-
        Calculate dependency files' combined hash value
        for use in the cache key
      id: calc-cache-key-files
      uses: ./.github/actions/cache-keys
    - name: Set up pip cache
      if: >-
        steps.request-check.outputs.release-requested != 'true'
      uses: re-actors/cache-python-deps@release/v1
      with:
        cache-key-for-dependency-files: >-
          ${{ steps.calc-cache-key-files.outputs.cache-key-for-dep-files }}
    - name: Drop Git tags from HEAD for non-release requests
      if: >-
        steps.request-check.outputs.release-requested != 'true'
      run: >-
        git tag --points-at HEAD
        |
        xargs git tag --delete
      shell: bash
    - name: Set up versioning prerequisites
      if: >-
        steps.request-check.outputs.release-requested != 'true'
      run: >-
        python -m
        pip install
        --user
        setuptools-scm
      shell: bash
    - name: Set the current dist version from Git
      if: steps.request-check.outputs.release-requested != 'true'
      id: scm-version
      run: |
        from os import environ
        from pathlib import Path

        import setuptools_scm

        FILE_APPEND_MODE = 'a'

        ver = setuptools_scm.get_version(
          ${{
              steps.untagged-check.outputs.is-untagged-devel == 'true'
              && 'local_scheme="no-local-version"' || ''
          }}
        )
        with Path(environ['GITHUB_OUTPUT']).open(
                mode=FILE_APPEND_MODE,
        ) as outputs_file:
            print(f'dist-version={ver}', file=outputs_file)
    - name: Set the target Git tag
      id: git-tag
      run: |
        from os import environ
        from pathlib import Path

        FILE_APPEND_MODE = 'a'

        with Path(environ['GITHUB_OUTPUT']).open(
                mode=FILE_APPEND_MODE,
        ) as outputs_file:
            print(
                "tag=v${{
                    steps.request-check.outputs.release-requested == 'true'
                    && github.event.inputs.release-version
                    || steps.scm-version.outputs.dist-version
                }}",
                file=outputs_file,
            )
    - name: Set the expected dist artifact names
      id: artifact-name
      run: |
        from os import environ
        from pathlib import Path

        FILE_APPEND_MODE = 'a'

        whl_file_prj_base_name = '${{ env.PROJECT_NAME }}'.replace('-', '_')
        sdist_file_prj_base_name = whl_file_prj_base_name.replace('.', '_')

        with Path(environ['GITHUB_OUTPUT']).open(
                mode=FILE_APPEND_MODE,
        ) as outputs_file:
            print(
                f"sdist={sdist_file_prj_base_name !s}-${{
                    steps.request-check.outputs.release-requested == 'true'
                    && github.event.inputs.release-version
                    || steps.scm-version.outputs.dist-version
                }}.tar.gz",
                file=outputs_file,
            )
            print(
                f"wheel={whl_file_prj_base_name !s}-${{
                    steps.request-check.outputs.release-requested == 'true'
                    && github.event.inputs.release-version
                    || steps.scm-version.outputs.dist-version
                }}-py3-none-any.whl",
                file=outputs_file,
            )

  build:
    name: >-
      📦 ${{ needs.pre-setup.outputs.git-tag }}
      [mode: ${{
        fromJSON(needs.pre-setup.outputs.is-untagged-devel)
        && 'test' || ''
      }}${{
        fromJSON(needs.pre-setup.outputs.release-requested)
        && 'release' || ''
      }}${{
        (
          !fromJSON(needs.pre-setup.outputs.is-untagged-devel)
          && !fromJSON(needs.pre-setup.outputs.release-requested)
        ) && 'nightly' || ''
      }}]
    needs:
    - pre-setup

    runs-on: ubuntu-latest

    timeout-minutes: 2

    env:
      TOXENV: build-dists

    outputs:
      dists-base64-hash: ${{ steps.dist-hashes.outputs.combined-hash }}

    steps:
    - name: Switch to using Python 3.11
      uses: actions/setup-python@v5
      with:
        python-version: 3.11

    - name: Grab the source from Git
      uses: actions/checkout@v4
      with:
        fetch-depth: >-
          ${{
              fromJSON(needs.pre-setup.outputs.release-requested)
              && 1 || 0
          }}
        ref: ${{ github.event.inputs.release-committish }}

    - name: Set up pip cache
      uses: re-actors/cache-python-deps@release/v1
      with:
        cache-key-for-dependency-files: >-
          ${{ needs.pre-setup.outputs.cache-key-for-dep-files }}

    - name: Install tox
      run: >-
        python -m
        pip install
        --user
        tox

    - name: Pre-populate the tox env
      run: >-
        python -m
        tox
        --parallel auto
        --parallel-live
        --skip-missing-interpreters false
        --notest

    - name: Drop Git tags from HEAD for non-tag-create events
      if: >-
        !fromJSON(needs.pre-setup.outputs.release-requested)
      run: >-
        git tag --points-at HEAD
        |
        xargs git tag --delete
      shell: bash

    - name: Setup git user as [bot]
      if: >-
        fromJSON(needs.pre-setup.outputs.release-requested)
        || fromJSON(needs.pre-setup.outputs.is-untagged-devel)
      uses: fregante/setup-git-user@v2
    - name: >-
        Tag the release in the local Git repo
        as ${{ needs.pre-setup.outputs.git-tag }}
        for setuptools-scm to set the desired version
      if: >-
        fromJSON(needs.pre-setup.outputs.is-untagged-devel)
        || fromJSON(needs.pre-setup.outputs.release-requested)
      run: >-
        git tag
        -m '${{ needs.pre-setup.outputs.git-tag }}'
        '${{ needs.pre-setup.outputs.git-tag }}'
        --
        ${{ github.event.inputs.release-committish }}

    - name: Set static timestamp for dist build reproducibility
      # ... from the last Git commit since it's immutable
      run: >-
        echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)"
        >> "${GITHUB_ENV}"
    - name: Build dists
      run: >-
        python -m
        tox
        --parallel auto
        --parallel-live
        --skip-missing-interpreters false
        --skip-pkg-install
        --quiet
    - name: Verify that the artifacts with expected names got created
      run: >-
        ls -1
        'dist/${{ needs.pre-setup.outputs.sdist-artifact-name }}'
        'dist/${{ needs.pre-setup.outputs.wheel-artifact-name }}'
    - name: Generate dist hashes to be used for provenance
      id: dist-hashes
      run: >-
        echo "combined-hash=$(
        sha256sum
        '${{ needs.pre-setup.outputs.sdist-artifact-name }}'
        '${{ needs.pre-setup.outputs.wheel-artifact-name }}'
        | base64 -w0
        )"
        >> "${GITHUB_OUTPUT}"
      working-directory: dist
    - name: Store the distribution packages
      uses: actions/upload-artifact@v4
      with:
        name: >-
          ${{ needs.pre-setup.outputs.dists-artifact-name }}
        # NOTE: Exact expected file names are specified here
        # NOTE: as a safety measure — if anything weird ends
        # NOTE: up being in this dir or not all dists will be
        # NOTE: produced, this will fail the workflow.
        path: |
          dist/${{ needs.pre-setup.outputs.sdist-artifact-name }}
          dist/${{ needs.pre-setup.outputs.wheel-artifact-name }}
        retention-days: >-
          ${{
              (
                fromJSON(needs.pre-setup.outputs.release-requested)
              ) && 90 || 30
          }}

  lint:
    name: 🧹 Linters${{ '' }}  # nest jobs under the same sidebar category
    needs:
    - build
    - pre-setup  # transitive, for accessing settings
    strategy:
      matrix:
        runner-vm-os:
        - ubuntu-latest
        python-version:
        # - ~3.12.0-0
        - 3.11
        - >-
          3.10
        - 3.9
        toxenv:
        - pre-commit
        # - metadata-validation
        # - build-docs
        # - coverage-docs
        # - doctest-docs
        # - linkcheck-docs
        # - spellcheck-docs
        environment-variables:
        - ''
        tox-run-posargs:
        - ''
        xfail:
        - false
        check-name:
        - ''
      fail-fast: false
    uses: ./.github/workflows/reusable-tox.yml
    with:
      cache-key-for-dependency-files: >-
        ${{ needs.pre-setup.outputs.cache-key-for-dep-files }}
      check-name: >-
        ${{ matrix.check-name }}
      dists-artifact-name: >-
        ${{ needs.pre-setup.outputs.dists-artifact-name }}
      environment-variables: >-
        ${{ matrix.environment-variables }}
      python-version: >-
        ${{ matrix.python-version }}
      release-requested: >-
        ${{ needs.pre-setup.outputs.release-requested }}
      runner-vm-os: >-
        ${{ matrix.runner-vm-os }}
      source-tarball-name: >-
        ${{ needs.pre-setup.outputs.sdist-artifact-name }}
      timeout-minutes: 3
      toxenv: >-
        ${{ matrix.toxenv }}
      tox-run-posargs: >-
        ${{ matrix.tox-run-posargs }}
      upstream-repository-id: >-
        ${{ needs.pre-setup.outputs.upstream-repository-id }}
      xfail: >-
        ${{
          fromJSON(needs.pre-setup.outputs.is-yolo-mode)
          || fromJSON(matrix.xfail)
        }}
    secrets:
      codecov-token: ${{ secrets.CODECOV_TOKEN }}

  tests:
    name: 🧪 Tests${{ '' }}  # nest jobs under the same sidebar category

    needs:
    - build
    - pre-setup  # transitive, for accessing settings

    strategy:
      matrix:
        towncrier-version:
        - 24.8.0
        - 23.11.0
        - 23.6.0
        python-version:
        # NOTE: The latest and the lowest supported Pythons are prioritized
        # NOTE: to improve the responsiveness. It's nice to see the most
        # NOTE: important results first.
        - 3.13
        - 3.9
        - 3.12
        - 3.11
        - >-
          3.10
        runner-vm-os:
        - ubuntu-24.04
        - ubuntu-20.04
        - macos-14
        - macos-13
        - windows-latest
        toxenv:
        - py
        xfail:
        - false

    uses: ./.github/workflows/reusable-tox.yml
    with:
      built-wheel-names: >-
        ${{ needs.pre-setup.outputs.wheel-artifact-name }}
      cache-key-for-dependency-files: >-
        ${{ needs.pre-setup.outputs.cache-key-for-dep-files }}
      check-name: >-
        🧪 📝${{ matrix.towncrier-version }}
        /
        🐍${{ matrix.python-version }}
        /
        💻${{ matrix.runner-vm-os }}
      dists-artifact-name: >-
        ${{ needs.pre-setup.outputs.dists-artifact-name }}
      python-version: >-
        ${{ matrix.python-version }}
      release-requested: >-
        ${{ needs.pre-setup.outputs.release-requested }}
      runner-vm-os: >-
        ${{ matrix.runner-vm-os }}
      source-tarball-name: >-
        ${{ needs.pre-setup.outputs.sdist-artifact-name }}
      timeout-minutes: 5
      toxenv: >-
        ${{ matrix.toxenv }}
      tox-provision-args: >-
        --force-dep 'towncrier ~= ${{ matrix.towncrier-version }}'
      tox-run-posargs: >-
        --cov-report=xml:.tox/.tmp/.test-results/pytest-${{
          matrix.python-version
        }}/cobertura.xml
        --junitxml=.tox/.tmp/.test-results/pytest-${{
          matrix.python-version
        }}/test.xml
      tox-rerun-posargs: >-
        --no-cov
        -vvvvv
        --lf
      upstream-repository-id: >-
        ${{ needs.pre-setup.outputs.upstream-repository-id }}
      xfail: >-
        ${{
          fromJSON(needs.pre-setup.outputs.is-yolo-mode)
          || fromJSON(matrix.xfail)
        }}
    secrets:
      codecov-token: ${{ secrets.CODECOV_TOKEN }}

  check:  # This job does nothing and is only used for the branch protection
    if: always()

    needs:
    - lint
    - pre-setup  # transitive, for accessing settings
    - tests

    runs-on: ubuntu-latest

    timeout-minutes: 1

    steps:
    - name: Decide whether the needed jobs succeeded or failed
      uses: re-actors/alls-green@release/v1
      with:
        allowed-failures: >-
          ${{
            fromJSON(needs.pre-setup.outputs.is-yolo-mode)
            && 'lint, tests'
            || ''
          }}
        jobs: ${{ toJSON(needs) }}

  publish-pypi:
    name: >-
      📦
      Publish ${{ needs.pre-setup.outputs.git-tag }} to PyPI
    needs:
    - check
    - pre-setup  # transitive, for accessing settings
    if: >-
      always()
      && needs.check.result == 'success'
      && fromJSON(needs.pre-setup.outputs.release-requested)
      && needs.pre-setup.outputs.upstream-repository-id == github.repository_id

    runs-on: ubuntu-latest

    timeout-minutes: 2  # docker+network are slow sometimes

    environment:
      name: pypi
      url: >-
        https://pypi.org/project/${{ env.PROJECT_NAME }}/${{
          needs.pre-setup.outputs.dist-version
        }}

    permissions:
      contents: read  # This job doesn't need to `git push` anything
      id-token: write  # PyPI Trusted Publishing (OIDC)

    steps:
    - name: Download all the dists
      uses: actions/download-artifact@v4
      with:
        name: >-
          ${{ needs.pre-setup.outputs.dists-artifact-name }}
        path: dist/
    - name: >-
        📦
        Publish ${{ needs.pre-setup.outputs.git-tag }} to PyPI
        🔏
      uses: pypa/gh-action-pypi-publish@release/v1

  publish-testpypi:
    name: >-
      📦
      Publish ${{ needs.pre-setup.outputs.git-tag }} to TestPyPI
    needs:
    - check
    - pre-setup  # transitive, for accessing settings
    if: >-
      always()
      && needs.check.result == 'success'
      && (
        fromJSON(needs.pre-setup.outputs.is-untagged-devel)
        || fromJSON(needs.pre-setup.outputs.release-requested)
      )
      && needs.pre-setup.outputs.upstream-repository-id == github.repository_id
      && fromJSON(needs.pre-setup.outputs.publishing-to-testpypi-enabled)

    runs-on: ubuntu-latest

    timeout-minutes: 2  # docker+network are slow sometimes

    environment:
      name: testpypi
      url: >-
        https://test.pypi.org/project/${{ env.PROJECT_NAME }}/${{
          needs.pre-setup.outputs.dist-version
        }}

    permissions:
      contents: read  # This job doesn't need to `git push` anything
      id-token: write  # PyPI Trusted Publishing (OIDC)

    steps:
    - name: Download all the dists
      uses: actions/download-artifact@v4
      with:
        name: >-
          ${{ needs.pre-setup.outputs.dists-artifact-name }}
        path: dist/
    - name: >-
        📦
        Publish ${{ needs.pre-setup.outputs.git-tag }} to TestPyPI
        🔏
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        repository-url: https://test.pypi.org/legacy/

  post-release-repo-update:
    name: >-
      🏷️
      Publish post-release Git tag
      for ${{ needs.pre-setup.outputs.git-tag }}
    needs:
    - publish-pypi
    - pre-setup  # transitive, for accessing settings
    if: >-
      always()
      && needs.publish-pypi.result == 'success'

    runs-on: ubuntu-latest

    timeout-minutes: 2

    steps:
    - name: >-
        Check if the requested tag ${{ needs.pre-setup.outputs.git-tag }}
        is present and is pointing at the required commit ${{
          github.event.inputs.release-committish
        }}
      id: existing-remote-tag-check
      run: |
        REMOTE_TAGGED_COMMIT_SHA="$(
          git ls-remote --tags --refs $(git remote get-url origin) '${{
            needs.pre-setup.outputs.git-tag
          }}' | awk '{print $1}'
        )"

        if [[ "${REMOTE_TAGGED_COMMIT_SHA}" == '${{
          github.event.inputs.release-committish
        }}' ]]
        then
          echo "already-exists=true" >> "${GITHUB_OUTPUT}"
        fi

    - name: Fetch the src snapshot
      if: steps.existing-remote-tag-check.outputs.already-exists != 'true'
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        ref: ${{ github.event.inputs.release-committish }}
    - name: Setup git user as [bot]
      if: steps.existing-remote-tag-check.outputs.already-exists != 'true'
      # Refs:
      # * https://github.community/t/github-actions-bot-email-address/17204/6
      # * https://github.com/actions/checkout/issues/13#issuecomment-724415212
      uses: fregante/setup-git-user@v2

    - name: >-
        🏷️
        Tag the release in the local Git repo
        as ${{ needs.pre-setup.outputs.git-tag }}
      if: steps.existing-remote-tag-check.outputs.already-exists != 'true'
      run: >-
        git tag
        -m '${{ needs.pre-setup.outputs.git-tag }}'
        -m 'Published at https://pypi.org/project/${{
          env.PROJECT_NAME
        }}/${{
          needs.pre-setup.outputs.dist-version
        }}'
        -m 'This release has been produced by the following workflow run: ${{
          github.server_url
        }}/${{
          github.repository
        }}/actions/runs/${{
          github.run_id
        }}'
        '${{ needs.pre-setup.outputs.git-tag }}'
        --
        ${{ github.event.inputs.release-committish }}

    - name: >-
        🏷️
        Push ${{ needs.pre-setup.outputs.git-tag }} tag corresponding
        to the just published release back to GitHub
      if: steps.existing-remote-tag-check.outputs.already-exists != 'true'
      run: >-
        git push --atomic origin '${{ needs.pre-setup.outputs.git-tag }}'

  slsa-provenance:
    name: >-
      🔏
      Save in-toto SLSA provenance as a GitHub workflow artifact for
      ${{ needs.pre-setup.outputs.git-tag }}
    needs:
    - build
    - post-release-repo-update
    - pre-setup  # transitive, for accessing settings

    permissions:
      actions: read
      id-token: write
      contents: write

    # Can't pin with hash due to how this workflow works.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0  # yamllint disable-line rule:line-length
    with:
      base64-subjects: ${{ needs.build.outputs.dists-base64-hash }}

  publish-github-attestations:
    name: >-
      🔏
      Produce a GitHub-native Attestations for
      ${{ needs.pre-setup.outputs.git-tag }}
    needs:
    - post-release-repo-update
    - pre-setup  # transitive, for accessing settings
    if: >-
      always()
      && needs.post-release-repo-update.result == 'success'
    runs-on: ubuntu-latest

    timeout-minutes: 3

    permissions:
      attestations: write  # IMPORTANT: needed to persist attestations
      contents: read
      id-token: write  # IMPORTANT: mandatory for Sigstore signing

    steps:
    - name: Download all the dists
      uses: actions/download-artifact@v4
      with:
        name: >-
          ${{ needs.pre-setup.outputs.dists-artifact-name }}
        path: dist/

    - name: >-
        🔏
        Generate provenance attestations for the dists
      uses: actions/attest-build-provenance@v1
      with:
        subject-path: |
          dist/${{ needs.pre-setup.outputs.sdist-artifact-name }}
          dist/${{ needs.pre-setup.outputs.wheel-artifact-name }}

  publish-github-release:
    name: >-
      🏷️
      Publish a GitHub Release for
      ${{ needs.pre-setup.outputs.git-tag }}
    needs:
    - post-release-repo-update
    - pre-setup  # transitive, for accessing settings
    - publish-github-attestations
    - slsa-provenance
    if: >-
      always()
      && needs.post-release-repo-update.result == 'success'
    runs-on: ubuntu-latest

    timeout-minutes: 3

    permissions:
      contents: write
      discussions: write
      id-token: write  # IMPORTANT: mandatory for Sigstore signing

    steps:
    - name: Download all the dists
      uses: actions/download-artifact@v4
      with:
        name: >-
          ${{ needs.pre-setup.outputs.dists-artifact-name }}
        path: dist/
    - name: Download SLSA provenance in-toto files
      uses: actions/download-artifact@v4
      with:
        name: >-
          ${{ needs.slsa-provenance.outputs.provenance-name }}
        path: >-
          ${{ needs.slsa-provenance.outputs.provenance-name }}

    - name: Sign the dists with Sigstore
      uses: sigstore/gh-action-sigstore-python@v3.0.0
      with:
        inputs: >-
          dist/${{ needs.pre-setup.outputs.sdist-artifact-name }}
          dist/${{ needs.pre-setup.outputs.wheel-artifact-name }}

    - name: >-
        Publish a GitHub Release for
        ${{ needs.pre-setup.outputs.git-tag }}
        with Sigstore-signed artifacts
      uses: ncipollo/release-action@v1
      with:
        allowUpdates: false
        artifactErrorsFailBuild: false
        artifacts: |
          dist/${{ needs.pre-setup.outputs.sdist-artifact-name }}
          dist/${{ needs.pre-setup.outputs.sdist-artifact-name }}.sigstore.json
          dist/${{ needs.pre-setup.outputs.wheel-artifact-name }}
          dist/${{ needs.pre-setup.outputs.wheel-artifact-name }}.sigstore.json
          ${{ needs.slsa-provenance.outputs.provenance-name }}/*
        artifactContentType: raw  # Because whl and tgz are of different types
        body: >
          # Release ${{ needs.pre-setup.outputs.git-tag }}


          This release is published to
          https://pypi.org/project/${{ env.PROJECT_NAME }}/${{
            needs.pre-setup.outputs.dist-version
          }}.


          This release has been produced by the following workflow run: ${{
            github.server_url
          }}/${{
            github.repository
          }}/actions/runs/${{
            github.run_id
          }}.
        # bodyFile:  # FIXME: Use once Towncrier is integrated.
        commit: ${{ github.event.inputs.release-committish }}
        discussionCategory: Announcements
        draft: false
        name: ${{ needs.pre-setup.outputs.git-tag }}
        # omitBody: false
        omitBodyDuringUpdate: true
        omitName: false
        omitNameDuringUpdate: true
        omitPrereleaseDuringUpdate: true
        prerelease: false
        removeArtifacts: false
        replacesArtifacts: false
        tag: ${{ needs.pre-setup.outputs.git-tag }}
        token: ${{ secrets.GITHUB_TOKEN }}

...