python-publish.yml

name: Upload Python Package

on:
  release:
    types: [created]
  workflow_dispatch: {}

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22.14.0
          registry-url: https://registry.npmjs.org/

      - name: Upgrade npm
        run: |
          npm --version
          npm i -g npm@latest
          npm --version

      - name: Install uv (with cache)
        uses: astral-sh/setup-uv@v5
        with:
          python-version: "3.12"
          enable-cache: true

      - name: Install the project
        run: uv sync --all-extras --dev

      - name: Ensure npm uses OIDC (no token auth)
        shell: bash
        run: |
          rm -f ~/.npmrc .npmrc || true

      # Build using uv env so Python CLIs are available to npm scripts
      - name: Build (uses Python deps via uv)
        run: |
          uv run npm ci
          uv run npm run build

      # Publish with bare npm so it can do OIDC trusted publishing
      - name: Publish to npm (OIDC trusted publishing)
        run: |
          npm publish --provenance

      - name: Build and publish to PyPI
        run: |
          uv build
          uv publish --username=${{ secrets.PYPI_USERNAME }} --password=${{ secrets.PYPI_PASSWORD }}