publish-python-package.yml

name: publish-python-package

# Manual only. Never publishes on push or tag.
on:
  workflow_dispatch:
    inputs:
      target:
        description: "Publish target"
        required: true
        type: choice
        options:
          - testpypi
          - pypi

jobs:
  publish:
    runs-on: ubuntu-latest
    # Uses the GitHub environment matching the chosen target (testpypi / pypi),
    # so environment protection rules and secrets apply.
    environment: ${{ inputs.target }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Install build tooling
        run: python -m pip install --upgrade pip build twine
      - name: Build sdist and wheel
        run: |
          rm -rf dist build *.egg-info src/*.egg-info
          python -m build
      - name: twine check
        run: python -m twine check dist/*

      - name: Publish to TestPyPI
        if: ${{ inputs.target == 'testpypi' }}
        env:
          TWINE_USERNAME: __token__
          # Token comes from the repository/environment secret; never echoed.
          TWINE_PASSWORD: ${{ secrets.TEST_PYPI_API_TOKEN }}
        run: python -m twine upload --repository-url https://test.pypi.org/legacy/ dist/*

      - name: Publish to PyPI
        if: ${{ inputs.target == 'pypi' }}
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: python -m twine upload dist/*