Publish to PyPI workflow (omry/omegaconf)

# This workflow uploads OmegaConf to PyPI using Trusted Publishers
# Basics: https://docs.pypi.org/trusted-publishers/adding-a-publisher/
# Security model: https://docs.pypi.org/trusted-publishers/security-model/
name: Publish to PyPI
 
on:
  release:
    types: [created]
 
# Use separate jobs for building and publishing so that write 
# permissions are only accessible minimally.
#
# Both jobs require are run under the pypi-publish environment,
# which is configured to require review and approval from authorized
# maintainers.
jobs:
  build-artifacts:
    timeout-minutes: 30
    name: Build distribution artifacts
    runs-on: latchkey-small
    environment: pypi-publish 
    steps:
    - uses: actions/checkout@v5
 
    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        cache: 'pip'
        python-version: '3.11'
 
    - name: Set up Java
      uses: actions/setup-java@v5
      with:
        distribution: 'temurin'
        java-version: '11'
 
    - name: Install build dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build
 
    - name: Build distribution
      run: |
        python -m build
        python -m build subprojects/omegaconf-pydevd
 
    - name: Verify build artifacts
      run: |
        ls -lah dist/
        ls -lah subprojects/omegaconf-pydevd/dist/
        python -m pip install twine
        twine check dist/* subprojects/omegaconf-pydevd/dist/*
 
    - name: Stage publish artifacts
      run: |
        mkdir -p publish-dist
        cp dist/* publish-dist/
        cp subprojects/omegaconf-pydevd/dist/* publish-dist/
        ls -lah publish-dist/
 
    - name: Summarize publish artifacts
      run: |
        python - <<'PY' >> "$GITHUB_STEP_SUMMARY"
        import pathlib
        import tarfile
        import zipfile
 
        paths = [pathlib.Path("publish-dist")]
 
        def metadata_from_artifact(path: pathlib.Path) -> tuple[str, str]:
            if path.suffix == ".whl":
                with zipfile.ZipFile(path) as zf:
                    metadata_name = next(
                        name for name in zf.namelist() if name.endswith(".dist-info/METADATA")
                    )
                    metadata = zf.read(metadata_name).decode()
            else:
                with tarfile.open(path, "r:gz") as tf:
                    member = next(
                        member for member in tf.getmembers() if member.name.endswith("/PKG-INFO")
                    )
                    extracted = tf.extractfile(member)
                    assert extracted is not None
                    metadata = extracted.read().decode()
 
            name = ""
            version = ""
            for line in metadata.splitlines():
                if line.startswith("Name: "):
                    name = line.removeprefix("Name: ")
                elif line.startswith("Version: "):
                    version = line.removeprefix("Version: ")
                if name and version:
                    break
            return name, version
 
        seen = {}
        for directory in paths:
            for artifact in sorted(directory.glob("*")):
                if artifact.is_file():
                    name, version = metadata_from_artifact(artifact)
                    seen.setdefault((name, version), set()).add(artifact.name)
 
        print("## Packages prepared for PyPI")
        print()
        print("| Package | Version |")
        print("| --- | --- |")
        for name, version in sorted(seen):
            print(f"| {name} | {version} |")
        PY
 
    - name: Upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: dist
        path: publish-dist/*
        retention-days: 0
 
  pypi-publish:
    timeout-minutes: 30
    needs: build-artifacts
    name: Upload release to PyPI
    runs-on: latchkey-small
    environment: pypi-publish
    permissions:
      id-token: write  # IMPORTANT: mandatory for trusted publishing
    steps:
    - name: Download artifacts
      uses: actions/download-artifact@v5
      with:
        name: dist
        path: dist/
 
    - name: Show downloaded artifacts
      run: ls -lah dist/
 
    - name: Publish package distributions to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1