name: Release

on:
  release:
    types: [published]

permissions: {}

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - run: pipx run build

      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: distfiles
          path: dist/
          if-no-files-found: error

  upload-github:
    name: Upload (GitHub)
    runs-on: ubuntu-latest
    permissions:
      contents: write
    needs: build
    steps:
      # We need to be in a git repo for gh to work.
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: distfiles
          path: dist/

      - run: gh release upload "${TAG_NAME}" dist/*.{tar.gz,whl}
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.event.release.tag_name }}

  upload-pypi:
    name: Upload (PyPI)
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/poetry/
    permissions:
      id-token: write
    needs: build
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: distfiles
          path: dist/

      - uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
        with:
          print-hash: true
