python-publish.yml

name: Upload Python Package

on:
  release:
    types: [ published ]

jobs:
  bump-version:
    runs-on: ubuntu-latest
    steps:
      - name: Generate GitHub App token
        id: generate-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ vars.SDK_GENERATION_APP_ID }}
          private-key: ${{ secrets.SDK_GENERATION_APP_PRIVATE_KEY }}

      - name: Check out repository code
        uses: actions/checkout@v4
        with:
          token: ${{ steps.generate-token.outputs.token }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install bump-my-version
          npm i -g auto-changelog

      - name: Bump version
        run: |
          initialTag=${{ github.event.release.tag_name }}
          tag="${initialTag//[v]/}"
          echo $tag
          git remote update
          git fetch
          echo "finished fetching"
          git checkout --track origin/master
          echo "finished checkout"
          git config --global user.email "github-actions@github.com"
          git config --global user.name "Github Actions"
          echo "finished configuration"
          bump-my-version bump --config-file .bump_version.toml --current-version 0.0.0 --new-version $tag
          echo "bumpversion finished"
          auto-changelog
          git add .
          git commit -m "release $tag"
          git push

      - name: Move tag
        run: |
          TAG_NAME=${{ github.event.release.tag_name }}
          echo $TAG_NAME
          git tag --force $TAG_NAME
          git push --force origin $TAG_NAME

  publish:
    needs: bump-version
    runs-on: ubuntu-latest
    permissions:
      id-token: write  # Required for OIDC/Trusted Publishing
      contents: read
    steps:
      - name: Check out repository code
        uses: actions/checkout@v4
        with:
          ref: master
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install build

      - name: Build package
        run: python -m build

      - name: Publish package to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        # No user/password needed - OIDC handles authentication