publish.yml

---
name: Build and Publish

on:
  push:
    tags: ["v*"]

jobs:
  build-and-publish:
    name: Build and Publish
    environment: protected
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98

      - name: Setup Python
        uses: actions/setup-python@28f2168f4d98ee0445e3c6321f6e6616c83dd5ec
        with:
          python-version: "3.14"

      - name: Install Poetry
        uses: abatilo/actions-poetry@b8f6fe29ba2eb78e0d45ccbf41cd14154c4e25b2

      - name: Configure Poetry
        run: |
          poetry config virtualenvs.create true --local
          poetry config virtualenvs.in-project true --local

      - name: Install package
        run: poetry install

      - name: Validate version
        run: |
          TAG_VERSION=${GITHUB_REF#refs/tags/v}
          POETRY_VERSION=$(poetry version -s)

          if [ "$TAG_VERSION" != "$POETRY_VERSION" ]; then
            echo "Tag ($TAG_VERSION) doesn't match pyproject.toml ($POETRY_VERSION)"
            exit 1
          fi

      - name: Build package
        run: poetry build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b