# derived from https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#the-whole-ci-cd-workflow
name: Publish Python distribution to PyPI

on:
  release:
    types: [published]

env:
  ACT: false  # env.ACT == true when running inside nektos/act

jobs:
  build:
    name: Build distribution
    # based on https://stackoverflow.com/a/74318141
    if: ${{ github.event.release.target_commitish == 'main'}}
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4
      with:
        persist-credentials: false

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: "3.x"

    - name: Build a binary wheel and a source tarball
      run: pipx run build

    - name: Store the distribution packages
      uses: actions/upload-artifact@v4
      with:
        name: distfiles
        path: dist/
        if-no-files-found: error

  # taken from https://github.com/python-poetry/poetry/blob/b580e8aa4fbce53569420e7b42568dfd9e73519f/.github/workflows/release.yaml
  upload-built-distribution-to-github-release:
    name: Upload (GitHub)
    runs-on: ubuntu-latest
    permissions:
      contents: write
    needs: build
    steps:
      # Checking-out the project since the gh CLI expects to be called in the context of a git repository.
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Retrieve built distribution
        uses: actions/download-artifact@v4
        with:
          name: distfiles
          path: dist/

      - run: gh release upload "${TAG_NAME}" dist/*.{tar.gz,whl}
        # skip step when debugging locally via nektos/act
        if: ${{ !env.ACT }}
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.event.release.tag_name }}

  publish-to-pypi:
    name: Publish Python distribution to PyPI
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/d3lta  # pypi is case insensitive so d3lta == D3lta
    permissions:
      id-token: write  # IMPORTANT: mandatory for trusted publishing

    steps:
      - name: Retrieve built distribution
        uses: actions/download-artifact@v4
        with:
          name: distfiles
          path: dist/

      - name: Publish distribution to PyPI
        # skip step when debugging locally via nektos/act
        if: ${{ !env.ACT }}
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          print-hash: true