on:
  workflow_dispatch:
  push:
    tags:
      - "*.*.*"

name: release

permissions:
  contents: read

jobs:
  build:
    name: Build distributions for PyPI
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2

      - name: Set up Python
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0

      - name: Install build dependencies
        run: python -m pip install build

      - name: Build distributions
        run: python -m build

      - name: Upload distributions
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
        with:
          name: certifi-dists
          path: dist/

  pypi:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    environment: release

    needs:
      - build

    permissions:
      # Used to authenticate to PyPI via OIDC.
      id-token: write

    steps:
      - name: fetch dists
        uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: certifi-dists
          path: dist/

      - name: publish
        if: github.event_name == 'push'
        uses: pypa/gh-action-pypi-publish@81e9d935c883d0b210363ab89cf05f3894778450 # v1.8.14