Sort a test's imports the way the lint job does #99

	name: Upload Python Package to Pypi

	on:
	push:
	tags:
	- '[0-9]+.[0-9]+.[0-9]+'

	jobs:
	deploy:
	runs-on: ubuntu-latest
	permissions:
	contents: write # needed to create the GitHub release for the tag
	id-token: write # needed for PyPI trusted publishing (OIDC)

	steps:
	- name: Validate tag format (X.Y.Z)
	shell: bash
	run: \|
	TAG="${GITHUB_REF_NAME}"
	echo "Pushed tag: $TAG"
	if ! [[ "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
	echo "Tag must be X.Y.Z (e.g. 1.2.3). Got: $TAG"
	exit 1
	fi

	- uses: actions/checkout@v5

	- name: Install uv
	uses: astral-sh/setup-uv@v6
	with:
	python-version: '3.12'
	enable-cache: true

	- name: Validate pyproject.toml version matches tag
	run: \|
	uv run python - <<'PY'
	import os, pathlib, tomllib

	tag = os.environ["GITHUB_REF_NAME"]
	data = tomllib.loads(pathlib.Path("pyproject.toml").read_text(encoding="utf-8"))
	py_ver = data["project"]["version"]

	print(f"pyproject.toml version: {py_ver}")
	if py_ver != tag:
	raise SystemExit(f"Version mismatch: tag={tag} but pyproject.toml={py_ver}")
	PY

	- name: Build distributions
	run: uv build

	- name: Publish to PyPI (OIDC)
	uses: pypa/gh-action-pypi-publish@release/v1
	with:
	packages-dir: dist

	- name: Create GitHub release for tag
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	TAG="${GITHUB_REF_NAME}"
	if gh release view "$TAG" >/dev/null 2>&1; then
	echo "Release $TAG already exists, skipping."
	else
	gh release create "$TAG" \
	--title "$TAG" \
	--generate-notes \
	dist/*
	fi

Navigation Menu