publish.yml

name: Build Cross-build environment for pyodide-build

on:
  push:
    tags:        
      - '*' 

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    uses: ./.github/actions/build-xbuildenv

  publish:
    runs-on: ubuntu-latest
    needs: [build]
    if: >-
      github.repository == 'pyodide/pyodide-build-environment-nightly' &&
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags'))
    permissions:
      # Required to sign the attestations
      id-token: write
      attestations: write
      # Required to upload to a GitHub release identifier
      contents: write
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: cross-build-env
          path: dist
          merge-multiple: true

      - name: Generate attestations
        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
        with:
          subject-path: |
            dist/xbuildenv.tar.bz2
      
      - name: Calc release version
        id: release_version
        shell: bash
        run: |
          echo "release_version=${{ github.ref_name  }}" >> $GITHUB_OUTPUT

          cat $GITHUB_OUTPUT

      - name: Verify them, to ensure that the wheels they were attested correctly
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          gh attestation verify dist/xbuildenv.tar.bz2 --repo ${{ github.repository }}

      - name: Create GitHub release with these wheels
        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0
        with:
          files: |
            dist/*.tar.bz2
          fail_on_unmatched_files: true
          name: ${{ steps.release_version.outputs.release_version }}