pythonpublish.yml

name: Upload Python Package to Pypi

on:
  release:
    types: [ published ]

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Validate release tag and version (X.Y.Z and matches pyproject)
        shell: bash
        run: |
          TAG="${{ github.event.release.tag_name }}"
          echo "Release tag: $TAG"
          if ! [[ "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Tag must be X.Y.Z (e.g. 1.2.3). Got: $TAG"
            exit 1
          fi

      - uses: actions/checkout@v4

      - name: Validate pyproject.toml version matches tag
        run: |
          python - <<'PY'
          import pathlib
          import tomllib

          tag = "${{ github.event.release.tag_name }}"

          data = tomllib.loads(pathlib.Path("pyproject.toml").read_text(encoding="utf-8"))
          py_ver = data["project"]["version"]

          print(f"pyproject.toml version: {py_ver}")
          if py_ver != tag:
            raise SystemExit(f"Version mismatch: tag={tag} but pyproject.toml={py_ver}")
          PY

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Build distributions
        run: |
          python -m pip install --upgrade pip
          pip install build
          python -m build

      - name: Publish to PyPI (OIDC)
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist