release.yml

on:
  release:
    types: [published]


jobs:
  publish:
    name: publish python library
    timeout-minutes: 60
    runs-on: ledgerhq-shared-small
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        timeout-minutes: 10
        uses: actions/checkout@v4

      - name: Setup python / PDM
        timeout-minutes: 10
        uses: ./.github/actions/pdm

      - name: Install dependencies
        timeout-minutes: 10
        run: pdm install --dev --check --frozen-lockfile
        env:
          FURY_TOKEN: ${{ secrets.PYPI_DEPLOY_TOKEN}}

      - name: Build distribution artifacts
        timeout-minutes: 10
        run: pdm build

      - name: Generate build attestations
        timeout-minutes: 10
        uses: LedgerHQ/actions-security/actions/attest@actions/attest-1
        with:
          subject-path: dist/*

      - name: Sign distribution artifacts
        timeout-minutes: 10
        uses:  LedgerHQ/actions-security/actions/sign-blob@actions/sign-blob-1
        with:
          path: dist

      - name: Upload distribution artifacts to Ledger Artifactory repository
        timeout-minutes: 10
        env:
          PDM_PUBLISH_REPO: https://jfrog.ledgerlabs.net/artifactory/api/pypi/vault-pypi-prod-green
          PDM_PUBLISH_USERNAME: ${{ steps.jfrog-login.outputs.oidc-user }}
          PDM_PUBLISH_PASSWORD: ${{ steps.jfrog-login.outputs.oidc-token }}
        run: pdm publish --no-build