python-publish.yml

name: Publish Python Package

# Break-glass only. The normal path is sync-upstream-release.yml, which
# publishes the exact wheel its gate tested. Leaving `release: published`
# here would race that upload for the same version.
#
# Use this when the sync workflow cut a release and tagged it, but the PyPI
# upload alone failed. Give it that release's tag: it downloads the .whl and
# .tar.gz attached to the release -- the exact bytes the three-platform gate
# ran against -- and uploads those files unchanged.
#
# It deliberately does NOT build. A rebuild from master would upload bytes no
# gate ever saw, under a version number that already has a tested artifact
# attached to its GitHub release, which is precisely what the tested-wheel
# design exists to prevent.
on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'stepss release tag whose attached distributions to upload, e.g. v3.60'
        required: true
        type: string

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    environment: pypi
    permissions:
      contents: read
      id-token: write
    steps:
      # No checkout: nothing in the working tree is used or trusted. The
      # release assets are the whole input.
      - name: Download the release's distributions
        env:
          TAG: ${{ inputs.tag }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          # Same shape the sync workflow enforces on upstream tags, hyphen
          # excluded so a prerelease tag cannot be published by hand either.
          if ! printf '%s' "$TAG" | grep -qzE '^v[0-9][0-9A-Za-z.+]*$'; then
            echo "FAIL: refusing tag: it must match ^v[0-9][0-9A-Za-z.+]*\$ as a single line, with no hyphen"
            exit 1
          fi
          mkdir -p dist
          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
            --pattern '*.whl' --pattern '*.tar.gz' --dir dist
          ls -l dist

          # A release with no wheel, or with more than one, is not the state
          # this workflow is for; uploading blind would be a guess.
          # `find`, not `ls dist/*.whl`: an unmatched glob makes `ls` exit
          # non-zero, which under `set -o pipefail` would abort the step before
          # this clearer message is ever printed.
          WHEELS="$(find dist -maxdepth 1 -name '*.whl' | wc -l)"
          if [ "$WHEELS" -ne 1 ]; then
            echo "FAIL: expected exactly one .whl attached to $TAG, found $WHEELS"
            exit 1
          fi

          # The tag and the wheel must describe the same version, or the
          # release's assets were not produced by the sync workflow.
          VERSION="${TAG#v}"
          WHEEL="$(find dist -maxdepth 1 -name '*.whl')"
          case "$(basename "$WHEEL")" in
            stepss-"$VERSION"-*) echo "OK: $WHEEL matches $TAG" ;;
            *) echo "FAIL: $WHEEL does not match tag $TAG (expected stepss-$VERSION-*)"; exit 1 ;;
          esac

      # The same action the sync workflow uses, on bytes that were gated on
      # Linux, Windows and macOS before the release was cut. Authenticated by
      # OIDC trusted publishing, like the sync workflow: no secret is read
      # here, and the token GitHub mints names this repository and this
      # workflow file, both of which the publisher on PyPI is registered
      # against.
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/