python.yml

name: Test
on: [push, pull_request]

concurrency:
  group: cicd-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12"]
    steps:
      - uses: actions/checkout@v4
      - name: Setup Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        run: pip install '.[dev]'
      - name: Format
        run: ruff format --check .
      - name: Lint
        run: ruff check .
      - name: Type
        run: mypy
      - name: Test
        run: pytest

  publish:
    name: Build & Publish
    needs: test
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      # Used to authenticate to PyPI via OIDC.
      # Used to sign the release's artifacts with sigstore-python.
      id-token: write
      # Used to attach signing artifacts to the published release.
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.9"
      - name: Install build deps
        run: pip install --upgrade build
      - name: Build Python package
        run: python -m build
      - name: Publish to PyPi
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          verbose: true
          print-hash: true