name: Publish to PyPI

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      publish_to_test:
        description: 'Publish to TestPyPI instead of PyPI'
        required: false
        type: boolean
        default: true

permissions:
  contents: read

jobs:
  build:
    name: Build distribution
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'

    - name: Install build dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build twine

    - name: Build package
      run: python -m build

    - name: Check distribution
      run: twine check dist/*

    - name: Upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: python-package-distributions
        path: dist/

  publish-to-testpypi:
    name: Publish to TestPyPI
    if: github.event_name == 'workflow_dispatch' && github.event.inputs.publish_to_test == 'true'
    needs: [build]
    runs-on: ubuntu-latest

    environment:
      name: testpypi
      url: https://test.pypi.org/p/context-as-a-service

    permissions:
      id-token: write

    steps:
    - name: Download distributions
      uses: actions/download-artifact@v4
      with:
        name: python-package-distributions
        path: dist/

    - name: Publish to TestPyPI
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        repository-url: https://test.pypi.org/legacy/

  publish-to-pypi:
    name: Publish to PyPI
    if: github.event_name == 'release' && github.event.action == 'published'
    needs: [build]
    runs-on: ubuntu-latest

    environment:
      name: pypi
      url: https://pypi.org/p/context-as-a-service

    permissions:
      id-token: write

    steps:
    - name: Download distributions
      uses: actions/download-artifact@v4
      with:
        name: python-package-distributions
        path: dist/

    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1

  github-release:
    name: Sign and upload to GitHub Release
    needs: [publish-to-pypi]
    runs-on: ubuntu-latest

    permissions:
      contents: write
      id-token: write

    steps:
    - name: Download distributions
      uses: actions/download-artifact@v4
      with:
        name: python-package-distributions
        path: dist/

    - name: Sign distributions with Sigstore
      uses: sigstore/gh-action-sigstore-python@v3.0.0
      with:
        inputs: >-
          ./dist/*.tar.gz
          ./dist/*.whl

    - name: Upload to GitHub Release
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: |
        gh release upload \
          '${{ github.ref_name }}' dist/** \
          --repo '${{ github.repository }}'
