release.yml

name: CD

on:
  release:
    types: [published]
  workflow_dispatch:
  schedule:
    - cron: "0 3 * * 1"

env:
  FORCE_COLOR: 3

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup Python
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: "3.12"

      - name: Build
        run: |
          python -m pip install build
          python -m build .

      - name: Store the distribution packages
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: python-package-distributions
          path: dist/
          if-no-files-found: error

  publish:
    name: Publish to PyPI
    needs: [build]
    runs-on: ubuntu-latest
    if: github.event_name == 'release' && github.event.action == 'published'
    environment:
      name: pypi
      url: https://pypi.org/p/pyodide-build
    permissions:
      id-token: write # IMPORTANT: mandatory for trusted publishing
      attestations: write
      contents: read
    steps:
      - name: Download all the dists
        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
        with:
          path: dist/
          merge-multiple: true

      - name: Generate artifact attestations
        uses: actions/attest-build-provenance@bd77c077858b8d561b7a36cbe48ef4cc642ca39d # v2.2.2
        with:
          subject-path: "dist/*"

      - name: Publish distribution 📦 to PyPI
        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4