publish_to_pypi.yml

name: Publish to PyPI

on:
  push:
    paths:
      - version.bzl
    branches: [ main ]
  workflow_dispatch:

jobs:
  build-binaries:
    name: Build binaries
    uses: ./.github/workflows/build_binaries.yml
  test:
    name: Test
    uses: ./.github/workflows/pyrefly.yml
  pypi-publish:
    name: Upload to PyPI
    runs-on: ubuntu-latest
    needs:
      - build-binaries
      - test
    environment:
      name: pypi
      url: https://pypi.org/p/pyrefly
    permissions:
      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
    steps:
      - name: Download dist
        uses: actions/download-artifact@v7
        with:
          name: dist
          path: dist
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # release/v1.13
  push-tag:
    name: Push version tag
    runs-on: ubuntu-latest
    needs: pypi-publish  # Don't push a tag unless the publish job succeeds
    steps:
      - name: Checkout repo
        uses: actions/checkout@v6
        with:
          fetch-depth: 0  # Get all history for all branches and tags
      - name: Get version
        run: |
          # setting to variable is necessary so sed failures will be red
          VERSION=$(sed -n -e 's/^VERSION = "\(.*\)"/\1/p' version.bzl)
          echo "PYREFLY_VERSION=$VERSION" >> $GITHUB_ENV
      - name: Tag commit
        run: git tag ${{ env.PYREFLY_VERSION }}
      - name: Push tag
        run: git push origin tag ${{ env.PYREFLY_VERSION }}