.github/workflows/publish_pypi.yaml

name: Publish to PyPI

on:
  workflow_call:
    inputs:
      tag_name:
        description: "release tag: tag that will be released"
        required: true
        type: string
  workflow_dispatch:
    inputs:
      tag_name:
        description: "release tag: tag that will be released"
        required: true
        type: string

jobs:
  publish_pypi:
    name: Publish runfiles to PyPI
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.tag_name || github.ref_name }}
      - env:
          # This special value tells pypi that the user identity is supplied within the token
          TWINE_USERNAME: __token__
          # Note, the PYPI_API_TOKEN is for the rules-python pypi user, added by @rickylev on
          # https://github.com/bazel-contrib/rules_python/settings/secrets/actions
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
        run: bazel run --stamp --embed_label=${{ inputs.tag_name || github.ref_name }} //python/runfiles:wheel.publish