publish.yml

name: Publish

on:
  release:
    types: [published]

defaults:
  run:
    shell: bash

concurrency:
  group: '${{ github.workflow }}-${{ github.ref }}'
  cancel-in-progress: true

env:
  PIP_DISABLE_PIP_VERSION_CHECK: 1
  PYTHONUNBUFFERED: 1
  FORCE_COLOR: 1

permissions:
  contents: read


jobs:

  build:
    if: github.repository == 'jamielinux/pyright-polite'
    name: 'Build'
    timeout-minutes: 20
    runs-on: ubuntu-latest

    steps:

      - name: 'Harden Runner'
        uses: step-security/harden-runner@03bee3930647ebbf994244c21ddbc0d4933aab4f  # v2.3.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            files.pythonhosted.org:443
            github.com:443
            pypi.org:443

      - name: 'Checkout'
        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3  # v3.5.0

      - name: 'Install dependencies'
        run: |
          python -m pip install --upgrade build

      - name: 'Build'
        run: |
          python -m build

      - name: 'Upload dist'
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce  # v3.1.2
        with:
          name: dist
          path: 'dist/*'
          if-no-files-found: error
          retention-days: 30


  publish:
    if: github.repository == 'jamielinux/pyright-polite'
    name: 'Publish to PyPI'
    timeout-minutes: 20
    runs-on: ubuntu-latest
    needs: [build]

    steps:

      - name: 'Harden Runner'
        uses: step-security/harden-runner@03bee3930647ebbf994244c21ddbc0d4933aab4f  # v2.3.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            pypi.org:443
            pypi.python.org:443
            upload.pypi.org:443

      - name: 'Download dist'
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3.0.2
        with:
          name: dist
          path: dist

      - name: 'Publish'
        uses: pypa/gh-action-pypi-publish@0bf742be3ebe032c25dd15117957dc15d0cfc38d  # v1.8.5
        with:
          user: __token__
          password: ${{ secrets.PYPI_TOKEN }}
          print-hash: true