release.yml

name: Release to PyPI

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  # Checks and build via the shared reusable workflow, which uploads
  # the built distributions as a "dist" artifact.
  py-checks:
    uses: chatmail/workflows/.github/workflows/py-checks.yml@main

  # The publish job must stay here in the repo's own workflow: PyPI
  # trusted publishing rejects publishes from reusable workflows.
  # See https://github.com/pypi/warehouse/issues/11096
  publish:
    needs: py-checks
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: dist
          path: dist/

      # This job may publish to PyPI in our name, so the action is
      # pinned to an immutable commit. "@release/v1" is a branch:
      # it would run whatever it points at on the day.
      - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
        with:
          # Fail loudly instead of skipping silently when the
          # version was already published.
          skip-existing: false