Add first version of automatic deployment workflow

Author: birkholz-cubert

.github/workflows/publish_version.yml

@@ -0,0 +1,126 @@
+name: Publish to PyPI
+
+on:
+  workflow_dispatch:
+    inputs:
+      repository:
+        description: "Target index"
+        type: choice
+        options: [pypi, testpypi]
+        default: testpypi
+      ref:
+        description: "Git ref to build (branch/tag/SHA). Leave empty to use the UI-selected ref."
+        required: false
+        default: ""
+
+concurrency:
+  group: pypi-publish
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    container:
+      image: cubertgmbh/cuvis_pyil:3.5.0-ubuntu24.04
+
+    environment: ${{ inputs.repository }}
+
+    permissions:
+      contents: read
+      id-token: write   # required for PyPI Trusted Publishing (OIDC)
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+
+      # Optional hard stop: only allow repo admins to proceed
+      - name: Enforce admin-only trigger
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const username = context.actor;
+
+            const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+              owner, repo, username
+            });
+
+            core.info(`Actor permission: ${data.permission}`);
+            if (data.permission !== "admin") {
+              core.setFailed(`Only repository admins may publish. (${username} has: ${data.permission})`);
+            }
+
+
+      - name: Install build tooling
+        run: python -m pip install --upgrade pip build
+
+      - name: Read package name/version from pyproject.toml
+        id: meta
+        run: |
+          python - <<'PY'
+          import sys, json
+          try:
+            import tomllib  # py3.11+
+          except ModuleNotFoundError:
+            import tomli as tomllib  # fallback if needed
+          from pathlib import Path
+
+          data = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))
+          proj = data.get("project", {})
+          name = proj.get("name")
+          version = proj.get("version")
+          if not name or not version:
+            print("Missing [project].name or [project].version in pyproject.toml", file=sys.stderr)
+            sys.exit(2)
+
+          print(f"name={name}")
+          print(f"version={version}")
+          with open("pkg_meta.json", "w", encoding="utf-8") as f:
+            json.dump({"name": name, "version": version}, f)
+          PY
+          echo "name=$(python -c "import json; print(json.load(open('pkg_meta.json'))['name'])")" >> "$GITHUB_OUTPUT"
+          echo "version=$(python -c "import json; print(json.load(open('pkg_meta.json'))['version'])")" >> "$GITHUB_OUTPUT"
+
+      - name: Abort if this version already exists on the target index
+        env:
+          NAME: ${{ steps.meta.outputs.name }}
+          VERSION: ${{ steps.meta.outputs.version }}
+          TARGET: ${{ inputs.repository }}
+        run: |
+          python - <<'PY'
+          import json, os, sys, urllib.request, urllib.error
+
+          name = os.environ["NAME"]
+          version = os.environ["VERSION"]
+          target = os.environ["TARGET"]
+
+          base = "https://pypi.org/pypi" if target == "pypi" else "https://test.pypi.org/pypi"
+          url = f"{base}/{name}/json"
+
+          try:
+            with urllib.request.urlopen(url) as resp:
+              data = json.load(resp)
+          except urllib.error.HTTPError as e:
+            if e.code == 404:
+              print(f"{name} not found on {target}; OK to publish {version}.")
+              sys.exit(0)
+            raise
+
+          releases = data.get("releases", {})
+          if version in releases and releases[version]:
+            print(f"Version {name}=={version} already exists on {target}. Aborting.")
+            sys.exit(1)
+
+          print(f"Version {name}=={version} not present on {target}; OK to publish.")
+          PY
+
+      - name: Build sdist and wheel
+        run: python -m build
+
+      - name: Publish (Trusted Publishing / OIDC)
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: ${{ inputs.repository == 'pypi' && 'https://upload.pypi.org/legacy/' || 'https://test.pypi.org/legacy/' }}