build-push.yml

name: Build and upload to PyPi

on:
  push:
    branches:
      - master
      - 'branch-**'
  workflow_dispatch:

jobs:
  build-and-publish:
    name: "Build wheels"
    uses: ./.github/workflows/lib-build.yml

  # Publishing is a separate job (not inside the reusable workflow) because PyPI Trusted Publishing
  # requires the *caller* workflow path in the OIDC token. A reusable workflow would embed its own
  # path instead, causing an `invalid-publisher` error on the PyPI side.
  # See: https://github.com/pypa/gh-action-pypi-publish/issues/166
  publish:
    name: "Publish wheels to PyPi"
    if: ${{ endsWith(github.event.ref, 'scylla') }}
    needs: build-and-publish
    runs-on: ubuntu-24.04
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          path: dist
          merge-multiple: true

      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true