name: Pip

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
    - master
    - stable
    - v*
  release:
    types:
    - published

permissions:
  contents: read

jobs:
  # This builds the sdists and wheels and makes sure the files are exactly as
  # expected.
  test-packaging:
    name: 🐍 3.9 • 📦 tests • windows-latest
    runs-on: windows-latest

    steps:
    - uses: actions/checkout@v7

    - name: Setup 🐍 3.9
      uses: actions/setup-python@v7
      with:
        python-version: 3.9

    - name: Install uv
      uses: astral-sh/setup-uv@v10.0.1

    - name: Prepare env
      run: uv pip install --system -r tests/requirements.txt

    - name: Python Packaging tests
      run: pytest tests/extra_python_package/


  # This runs the packaging tests and also builds and saves the packages as
  # artifacts.
  packaging:
    name: 🐍 3.9 • 📦 & 📦 tests • ubuntu-latest
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v7

    - name: Setup 🐍 3.9
      uses: actions/setup-python@v7
      with:
        python-version: 3.9

    - name: Install uv
      uses: astral-sh/setup-uv@v10.0.1

    - name: Prepare env
      run: uv pip install --system -r tests/requirements.txt twine nox

    - name: Python Packaging tests
      run: pytest tests/extra_python_package/

    - name: Build SDist and wheels
      run: |
        nox -s build
        nox -s build_global

    - name: Check metadata
      run: twine check dist/*

    - name: Save standard package
      uses: actions/upload-artifact@v7
      with:
        name: standard
        path: dist/pybind11-*

    - name: Save global package
      uses: actions/upload-artifact@v7
      with:
        name: global
        path: dist/*global-*


  # When a GitHub release is made, upload the artifacts to PyPI
  upload:
    name: Upload to PyPI
    runs-on: ubuntu-latest
    if: github.event_name == 'release' && github.event.action == 'published'
    needs: [packaging]
    environment:
      name: pypi
      url: https://pypi.org/p/pybind11
    permissions:
      id-token: write
      attestations: write

    steps:
    # Downloads all to directories matching the artifact names
    - uses: actions/download-artifact@v8

    - name: Generate artifact attestation for sdist and wheel
      uses: actions/attest-build-provenance@v4
      with:
        subject-path: "*/pybind11*"

    - name: Publish standard package
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        packages-dir: standard/

    - name: Publish global package
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        packages-dir: global/