Publish to (Test)PyPI workflow (tenpy/tenpy)

name: Publish to (Test)PyPI
# Build wheels and publish them to either TestPyPI (on pushing a tag)
#  or live PyPI (on creating a release)
 
on:
  # when a release is created (-> publish to live PyPI)
  release:
    types: [created]
 
  # when a tagged commit is pushed to *any* branch (-> publish to testPyPI)
  push:
    tags:
      - '**'  # on any tag
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  build-native-wheels:
    timeout-minutes: 30
    name: Build wheels on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-14]
 
    steps:
    - name: Checkout
      uses: actions/checkout@v5
 
    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        cache: 'pip'
        python-version: '3.x'
 
    - name: Build wheels
      # configuration in pyproject.toml
      uses: pypa/cibuildwheel@v3.2.1
      with:
        output-dir: dist
 
    - name: Upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: wheels-${{ matrix.os }}
        path: dist/*.whl
 
  build-sdist-and-upload:
    timeout-minutes: 30
    runs-on: latchkey-small
    needs: 'build-native-wheels'
    permissions:
      # allow trusted publishing / OIDC authentication for PyPI
      # corresponding authentication settings on {test.}pypi.org
      id-token: write
    steps:
    - name: Checkout
      uses: actions/checkout@v4
 
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        cache: 'pip'
        python-version: '3.x'
 
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        python -m pip install --upgrade build twine
 
    - name: Download wheels from build artifacts
      uses: actions/download-artifact@v4
      with:
        pattern: wheels-*
        merge-multiple: true
        path: dist-wheels/
 
    - name: Build package
      run: |
        python -m build --sdist
        python -m twine check --strict dist/*
        python -m twine check --strict dist-wheels/*
 
    # Publish to TestPyPI, only  if it is *not* a release
    #  For a release, pushing the unreleased tag should have already caused this workflow to
    #  publish to TestPyPI. Thus, we can not publish the same version number again.
    - name: Publish wheels to TestPyPI
      if: github.event_name != 'release'
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        repository-url: https://test.pypi.org/legacy/
        packages-dir: dist-wheels/
    - name: Publish sdist to TestPyPI
      if: github.event_name != 'release'
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        repository-url: https://test.pypi.org/legacy/
 
    # Publish to live PyPI *only on release*
    - name: Publish wheels to PyPI
      if: github.event_name == 'release'
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        packages-dir: dist-wheels/
    - name: Publish sdist to PyPI
      if: github.event_name == 'release'
      uses: pypa/gh-action-pypi-publish@release/v1