deploy.yml

name: deploy

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version'
        required: true
        default: '1.2.3'

jobs:

  package:
    runs-on: ubuntu-latest
    # Required by attest-build-provenance-github.
    permissions:
      id-token: write
      attestations: write
    env:
      SETUPTOOLS_SCM_PRETEND_VERSION: ${{ github.event.inputs.version }}

    steps:
    - uses: actions/checkout@v4

    - name: Build and Check Package
      uses: hynek/build-and-inspect-python-package@v2.6.0
      with:
        attest-build-provenance-github: 'true'


  deploy:
    needs: package
    runs-on: ubuntu-latest
    environment: deploy
    permissions:
      id-token: write  # For PyPI trusted publishers.
      contents: write  # For tag and release notes.

    steps:
    - uses: actions/checkout@v4

    - name: Download Package
      uses: actions/download-artifact@v4
      with:
        name: Packages
        path: dist

    - name: Publish package to PyPI
      uses: pypa/gh-action-pypi-publish@v1.8.14

    - name: Push tag
      run: |
        git config user.name "pytest bot"
        git config user.email "pytestbot@gmail.com"
        git tag --annotate --message=v${{ github.event.inputs.version }} v${{ github.event.inputs.version }} ${{ github.sha }}
        git push origin v${{ github.event.inputs.version }}

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: "3.10"

    - name: Generate release notes
      run: |
        pip install pypandoc
        sudo apt-get install pandoc
        python scripts/gen-release-notes.py

    - name: GitHub Release
      uses: softprops/action-gh-release@v2
      with:
        body_path: scripts/latest-release-notes.md
        files: dist/*
        tag_name: v${{ github.event.inputs.version }}