python-publish.yml

name: Publish to PyPI
on:
  push:
    tags:
      - 'v*' # Triggers only when a version tag is pushed
  workflow_dispatch: # Allows you to manually trigger a fix

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    environment:
      name: pypi

    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0 # Required to verify branch history

      - name: Verify tag is on main
        run: |
          if ! git branch -r --contains ${{ github.ref_name }} | grep -q "origin/main"; then
            echo "Error: Tag ${{ github.ref_name }} is not on the main branch. Aborting."
            exit 1
          fi

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install build tools
        run: python -m pip install --upgrade build

      - name: Build package
        run: python -m build

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1