obsidian-metadata/.github/workflows/pypi-release.yml

---
name: Publish to PyPi
on:
    workflow_dispatch:
    release:
        types:
            - published

concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true

jobs:
    publish-to-pypi:
        runs-on: ubuntu-latest
        strategy:
            fail-fast: true
            matrix:
                python-version: ["3.11"]
        steps:
            - name: Harden Security Runner
              uses: step-security/harden-runner@v2
              with:
                  egress-policy: block
                  disable-sudo: true
                  allowed-endpoints: >
                      api.github.com:443
                      files.pythonhosted.org:443
                      github.com:443
                      install.python-poetry.org:443
                      pypi.org:443
                      python-poetry.org:443
                      upload.pypi.org:443

            - name: Checkout repository
              uses: actions/checkout@v4

            - name: Setup Python and Poetry
              uses: ./.github/actions/setup-poetry

            # ----------------------------------------------
            # Test and then build the package
            # ----------------------------------------------
            - name: run poetry build
              run: |
                  poetry run poetry check
                  poetry run coverage run

            # ----------------------------------------------
            # Publish to PyPi
            # ----------------------------------------------
            - name: Publish
              env:
                  PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
              run: |
                  poetry config pypi-token.pypi $PYPI_TOKEN
                  poetry publish --build