release.yml

name: release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Git tag to publish (e.g. v1.1.0). Leave blank to use latest tag."
        required: false

permissions:
  contents: read
  id-token: write   # needed for PyPI Trusted Publishing

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: determine tag
        id: tag
        run: |
          git fetch --tags
          if [ -z "${{ inputs.tag }}" ]; then
            TAG=$(git describe --tags "$(git rev-list --tags --max-count=1)")
          else
            TAG=${{ inputs.tag }}
          fi
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "Publishing tag: $TAG"

      - name: checkout tag
        run: |
          git checkout ${{ steps.tag.outputs.tag }}

      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - run: |
          python -m pip install --upgrade pip build
          python -m build

      - name: publish to PyPI (trusted)
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist