wheels.yml

# Build a wheel and publish to PyPI when a pull request merges.
# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
#
# We need access to the repo secrets, which are only available using the pull_request_target trigger.
# For security this requires us to use the repo HEAD and not the PR merge commit.
# But since this action only executes on merge, those are the same thing.
# https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target

name: Build wheel

on:
  pull_request_target:
    types:
      - closed
    branches:
      - main
      
permissions:
  contents: read
  pull-requests: read
  id-token: write

jobs:
  build_and_publish:
    if: github.event.pull_request.merged == true
    runs-on: ubuntu-latest
    environment: release
    permissions:
      # IMPORTANT: this permission is mandatory for trusted publishing
      id-token: write
    
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.x"
      - name: Build wheel
        run: |
          python -m pip install --user --upgrade pip build wheel
          python -m build
      - name: Publish distribution to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1