release.yml

# Copyright the Hyperledger Fabric contributors. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

name: Release

# IMPORTANT: PyPI validates against the filename (release.yml),
# the owner, and the repo registered in the Trusted Publisher. If you change
# the filename, update the registration on pypi.org.
on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
      - "v[0-9]+.[0-9]+.[0-9]+-*"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment: pypi          # Must exist in GitHub AND be registered in PyPI
    permissions:
      id-token: write          # OIDC: mandatory for Trusted Publishing
      contents: read

    steps:
      # The hashes correspond to the most recent versions at the time of this
      # analysis; update via Dependabot (see dependabot.yml).
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install build dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install build setuptools wheel

      - name: Build distribution
        run: python -m build --sdist --wheel

      # Trusted Publishing: no password required. The action obtains an ephemeral
      # OIDC token signed by GitHub, which PyPI validates against the
      # registered publisher. There are no secrets to rotate or leak.
      - name: Publish to PyPI
        if: startsWith(github.ref, 'refs/tags/')
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
        # attestations: true   # optional: generate PEP 740 attestations (supply chain)