Merge pull request #169 from kannkyo/kannkyo-patch-1 #71

	name: Python Publish

	on:
	workflow_dispatch: # for debug
	push:
	branches: [main]
	tags:
	- v..*

	permissions: read-all

	jobs:
	release:
	runs-on: ubuntu-latest
	if: ${{ github.ref_name != 'main' }}
	permissions:
	contents: write
	packages: write
	id-token: write
	attestations: write
	steps:
	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

	- name: Setup python environment
	uses: ./.github/actions/python-setup

	- name: Build package
	id: build
	run: \|
	poetry run seman sbom
	poetry build
	echo "package_tar=`ls dist/ \| grep .tar.gz`" >> $GITHUB_OUTPUT
	echo "package_whl=`ls dist/ \| grep .whl`" >> $GITHUB_OUTPUT

	- name: Upload package to artifact
	uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
	with:
	name: package
	path: dist/

	- name: Upload package to release asset
	uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	with:
	generate_release_notes: true
	files: \|
	dist/${{ steps.build.outputs.package_tar }}
	dist/${{ steps.build.outputs.package_whl }}

	- name: Upload package to pypi
	uses: pypa/gh-action-pypi-publish@67339c736fd9354cd4f8cb0b744f2b82a74b5c70
	with:
	user: __token__
	password: ${{ secrets.PYPI_API_TOKEN }}

	- name: attest build provenance
	uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb
	with:
	subject-path: \|
	dist/${{ steps.build.outputs.package_tar }}
	dist/${{ steps.build.outputs.package_whl }}

Provide feedback