Publish to PyPI workflow (thinkst/opencanary)

name: Publish to PyPI
on:
  release:
    types:
      - published
 
  workflow_dispatch:
 
jobs:
  pypi-publish:
    timeout-minutes: 30
    name: Upload release to PyPI
    runs-on: latchkey-small
    environment:
      name: release
      url: https://pypi.org/p/opencanary
    permissions:
      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
    steps:
    # retrieve your distributions here
    - name: Set up Python
      uses: actions/setup-python@v3
      with:
        cache: 'pip'
    - name: "Check out repository code"
      uses: "actions/checkout@v6"
    - name: Install uv
      uses: astral-sh/setup-uv@v7
    - name: Install setuptools
      run: pip3 install setuptools>=63.2.0
    - name: Install wheel
      run: pip3 install wheel
    - name: Build package distributions
      run: uv build
    - name: check version matches tag
      run: |
            uv pip install --system dist/*.tar.gz
            version_to_release=$(opencanaryd --version)
            tag_name="${{ github.event.release.tag_name }}"
            tag_name_without_v="${tag_name#v}"
            if [[ "$version_to_release" == "$tag_name_without_v" ]]; then
                echo "Versions match - may it be a great release"
                exit 0
            else
              echo "Versions do not match - not publishing"
              echo "Opencanary version is: $version_to_release"
              echo "Git tag is: $tag_name -> $tag_name_without_v"
              exit 1
            fi
    - name: Publish
      run: uv publish