release.yml

name: Release

on:
  push:

jobs:
  build:
    name: Build artifacts
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - uses: hynek/build-and-inspect-python-package@v2

  check-tag:
    name: Check tag
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    outputs:
      is_final: ${{ steps.check.outputs.is_final }}
    steps:
    - name: Check if tag is a pre-release
      id: check
      run: |
        echo "is_final=$(echo '${{ github.ref }}' | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$' && echo 'true' || echo 'false')" >> $GITHUB_OUTPUT

  provenance:
    name: Provenance
    runs-on: ubuntu-latest
    needs: [build]
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write     # Needed for attestations
      attestations: write # Needed for attestations
    outputs:
      bundle-path: ${{ steps.attest.outputs.bundle-path }}
    steps:
    - uses: actions/download-artifact@v4
      with:
        name: Packages
        path: dist
    - uses: actions/attest-build-provenance@v2
      id: attest
      with:
        subject-path: "./dist/singer_sdk*"
    - uses: actions/upload-artifact@v4
      with:
        name: Attestations
        path: ${{ steps.attest.outputs.bundle-path }}

  publish:
    name: PyPI
    runs-on: ubuntu-latest
    needs: [build]
    environment:
      name: publishing
      url: https://pypi.org/p/singer-sdk
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write  # Needed for OIDC PyPI publishing
    steps:
    - uses: actions/download-artifact@v4
      with:
        name: Packages
        path: dist
    - name: Publish
      uses: pypa/gh-action-pypi-publish@v1.12.2

  upload-to-release:
    name: Upload files to release
    runs-on: ubuntu-latest
    needs: [build, check-tag, provenance]
    if: ${{ startsWith(github.ref, 'refs/tags/') && needs.check-tag.outputs.is_final == 'true' }}
    permissions:
      contents: write     # Needed for uploading files to the release

    steps:
    - uses: actions/download-artifact@v4
      with:
        name: Packages
        path: dist

    - uses: actions/download-artifact@v4
      with:
        name: Attestations
        path: attestations

    - name: Upload wheel and sdist to release
      uses: svenstaro/upload-release-action@v2
      with:
        file: dist/singer_sdk*
        tag: ${{ github.ref }}
        overwrite: true
        file_glob: true

    - name: Upload attestations to release
      uses: svenstaro/upload-release-action@v2
      with:
        file: attestations/attestation.jsonl
        tag: ${{ github.ref }}
        overwrite: true
        asset_name: attestations.intoto.jsonl