release.yml

name: Build package and publish to GitHub and Test PyPI

on:
  push:
    tags:
      - 'v*'

jobs:

  build:
    name: "Build package"
    runs-on: ubuntu-latest
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}

    steps:
      - name: "Checkout repository"
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0

      - name: "Setup Python"
        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
        with:
          python-version: "3.x"

      - name: "Install dependencies"
        run: pip install -r requirements/build.txt

      # Use the commit date instead of the current date during the build.
      - name: "Build dists"
        run: |
          SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) \
          python -m build

      # Generate hashes used for provenance.
      - name: "Generate hashes"
        id: hash
        run: |
          cd dist && echo "hashes=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT

      - name: "Upload dists"
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
          name: "dist"
          path: "dist/"
          if-no-files-found: error
          retention-days: 5

  provenance:
    name: "Generate provenance"
    needs: [ build ]
    permissions:
      actions: read
      contents: write
      id-token: write # Needed to access the workflow's OIDC identity.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      upload-assets: true

#  create-github-release:
#    # Upload the sdist, wheels, and provenance to a GitHub release. They remain
#    # available as build artifacts for a while as well.
#    name: "Create GitHub release"
#    needs: [ provenance ]
#    runs-on: ubuntu-latest
#    permissions:
#      contents: write
#    steps:
#      - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
#
#      - name: Create a GitHub release
#        run: >
#          gh release create "${{ github.ref_name }}" \
#            dist/* \
#            --repo "${{ github.repository }}" \
#            --title "${{ github.ref_name }}" \
#            --draft \
#            --verify-tag \
#            --generate-notes
#        env:
#          GH_TOKEN: ${{ github.token }}