python-publish.yml

name: python-publish

on:
  release:
    types:
      - published
  workflow_dispatch:

permissions:
  contents: read

jobs:
  publish:
    if: |
      (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'python/')) ||
      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v3
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Install uv
        run: |
          curl -LsSf https://astral.sh/uv/install.sh | sh
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH

      - name: Install dependencies
        run: |
          make install
          uv pip install build
        working-directory: python

      - name: Copy README.md
        run: |
          cp README.md python/README.md

      - name: Build package
        run: uv run python -m build
        working-directory: python

      # Sanity check.
      # `-m "not integration"` deselects voice e2e tests (auto-marked by
      # tests/voice/conftest.py). Those hit live providers, require API
      # key secrets we don't expose to the publish workflow, and run
      # on-demand via voice-integration.yml. Mirrors python-ci.yml.
      - name: Run tests
        run: |
          uv run pytest tests -m "not integration"
        working-directory: python

      - name: Publish package
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: python/dist/
          user: __token__
          password: ${{ secrets.PYPI_API_TOKEN }}
          attestations: false