publish.yaml

# Builds jsonpatch and uploads it to PyPI when a GitHub release is published.
#
# Uploads use PyPI Trusted Publishing (OpenID Connect), so no API token is
# stored in this repository. See RELEASING.md for the one-time setup on PyPI
# and GitHub, and for the release procedure.
#
# Running the workflow manually ("Run workflow" on the Actions tab) builds and
# checks the distributions without publishing them; tick "testpypi" to also
# upload them to TestPyPI.

name: Publish to PyPI

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      testpypi:
        description: Upload the distributions to TestPyPI
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  build:
    name: Build distributions
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.x"
      - name: Install build tools
        run: python -m pip install --upgrade build twine
      - name: Check that the release tag matches the package version
        if: github.event_name == 'release'
        env:
          TAG: ${{ github.event.release.tag_name }}
        run: |
          version=$(sed -n "s/^__version__ = '\(.*\)'$/\1/p" jsonpatch.py)
          if [ "${TAG#v}" != "$version" ]; then
            echo "::error::Release tag $TAG does not match __version__ = '$version' in jsonpatch.py"
            exit 1
          fi
      - name: Build sdist and wheel
        run: python -m build
      - name: Check distributions
        run: python -m twine check --strict dist/*
      - uses: actions/upload-artifact@v7
        with:
          name: python-package-distributions
          path: dist/
          if-no-files-found: error

  publish-to-pypi:
    name: Publish to PyPI
    if: github.event_name == 'release'
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/jsonpatch
    permissions:
      id-token: write  # required for Trusted Publishing

    steps:
      - uses: actions/download-artifact@v8
        with:
          name: python-package-distributions
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1

  publish-to-testpypi:
    name: Publish to TestPyPI
    if: github.event_name == 'workflow_dispatch' && inputs.testpypi
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: testpypi
      url: https://test.pypi.org/p/jsonpatch
    permissions:
      id-token: write  # required for Trusted Publishing

    steps:
      - uses: actions/download-artifact@v8
        with:
          name: python-package-distributions
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/
          # TestPyPI never accepts the same version twice; don't fail reruns.
          skip-existing: true