publish.yml

name: publish

on:
  push:
    # Full semver tags only (vX.Y.Z) trigger a PyPI release. The sliding major
    # tag (v1), which consumer workflows pin via @v1, must NOT trigger publish.
    tags: ["v*.*.*"]

jobs:
  build-and-publish:
    runs-on: ubuntu-24.04
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v8.2.0
      - run: uv sync --all-extras

      - name: Verify tag matches package version
        run: |
          TAG="${GITHUB_REF#refs/tags/v}"
          PKG=$(uv run python -c "import repro_lambda; print(repro_lambda.__version__)")
          if [[ "$TAG" != "$PKG" ]]; then
            echo "tag $TAG != package version $PKG" >&2
            exit 1
          fi

      - name: Build sdist + wheel
        run: uv build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/