release.yml

name: Upload Python Package

on:
  workflow_run:
    workflows: [build_wheels, build_sdist]
    types:
      - completed

jobs:
    publish_artifacts:
      runs-on: ubuntu-latest
      environment: release
      permissions:
        # IMPORTANT: this permission is mandatory for trusted publishing
        id-token: write
      # upload to PyPI on every tag starting with 'v'
      # if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v')
      # alternatively, to publish when a GitHub Release is created, use the following rule:
      if: ${{ github.event.workflow_run.conclusion == 'success' }} && github.event_name == 'release' && github.event.action == 'published'
      steps:
        - name: Download builds
          uses: actions/download-artifact@v4
          with:
            path: dist
            pattern: cibw-*
            merge-multiple: true

        - name: upload to pypi
          uses: pypa/gh-action-pypi-publish@release/v1

        - name: publish to github release
          uses: softprops/action-gh-release@v2
          permissions:
            contents: write
          if: startsWith(github.ref, 'refs/tags/')
          with:
            files: dist/*