publish-release.yml

name: Maestro Releases to PyPi
on:
  push:
    tags:
      - '[0-9]+.[0-9]+[0-9]+.[0-9]'
      - '[0-9]+.[0-9]+.[0-9]'

  workflow_dispatch:

permissions: {} # Explicitly remove all permissions by default

jobs:
  publish-release:
    name: Publish Release Package
    runs-on: ubuntu-latest
    environment:
      name: release
      url: https://pypi.org/project/maestro/
    timeout-minutes: 10
    permissions:
      id-token: write # Required for PyPI publishing
      contents: read # Required for checkout
    strategy:
      matrix:
        python-version: ["3.10"]
    steps:
      - name: 🛎️ Checkout
        uses:  actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ github.head_ref }}
      - name: 🐍 Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: ${{ matrix.python-version }}

      - name:  🏗️ Build source and wheel distributions
        run: |
          python -m pip install --upgrade build twine
          python -m build
          twine check --strict dist/*
      - name: 🚀 Publish to PyPi - Release
      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
        with:
          attestations: true