publish.yml

# Sources:
# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#workflow-definition
# https://github.com/marketplace/actions/pypi-publish

name: Publish package and docs

on:
  push:
    branches: [ release ]

jobs:
  build-and-test:
    uses: ./.github/workflows/build-and-test.yml

  create-tag:
    name: Create Git Tag
    needs: build-and-test
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Create Git Tag
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        VERSION: ${{ needs.build-and-test.outputs.version }}
      run: |
        git config --global user.name 'github-actions'
        git config --global user.email 'github-actions@github.com'
        git tag "v${VERSION}"
        git push origin "v${VERSION}"

  publish-to-pypi:
    name: Publish to PyPI
    needs: [build-and-test, create-tag]
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/paradigma
    permissions:
      id-token: write  # mandatory for trusted publishing

    steps:
    - name: Download all the dists
      uses: actions/download-artifact@v4
      with:
        name: build-artifacts
        path: dist/
    - name: Publish distribution 📦 to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1


  github-release:
    name: Sign distribution and create GitHub release
    needs: [build-and-test, create-tag]
    runs-on: ubuntu-latest

    permissions:
      contents: write  # mandatory for making GitHub Releases
      id-token: write  # mandatory for sigstore

    steps:
    - name: Download all the dists
      uses: actions/download-artifact@v4
      with:
        name: build-artifacts
        path: dist/

    - name: Sign the dists with Sigstore
      uses: sigstore/gh-action-sigstore-python@v2.1.1
      with:
        inputs: >-
          ./dist/*.tar.gz
          ./dist/*.whl

    - name: Create GitHub Release
      env:
        GITHUB_TOKEN: ${{ github.token }}
        VERSION: ${{ needs.build-and-test.outputs.version }}
      run: >-
        gh release create
        "v${VERSION}"
        --repo '${{ github.repository }}'
        --notes ""

    - name: Upload artifact signatures to GitHub Release
      env:
        GITHUB_TOKEN: ${{ github.token }}
        VERSION: ${{ needs.build-and-test.outputs.version }}
      # Upload to GitHub Release using the `gh` CLI.
      # `dist/` contains the built packages, and the
      # sigstore-produced signatures and certificates.
      run: >-
        gh release upload
        "v${VERSION}" dist/**
        --repo '${{ github.repository }}'


  publish-docs:
    name: Publish documentation
    needs: build-and-test
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download the documentation
        uses: actions/download-artifact@v4
        with:
          name: docs-html
          path: docs/
      - name: Deploy
        uses: peaceiris/actions-gh-pages@v3
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: docs/