name: Publish Python package to TestPyPI

on:
  push:
    tags:
      - '*'

jobs:
  publish:
    name: Publish to TestPyPI
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')  # Only run on tagged commits

    steps:
    - name: Check out code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0  # This fetches all history for all branches and tags

    - name: Verify tag is on master branch
      run: |
        TAG_SHA=$(git rev-parse ${{ github.ref }})
        MASTER_SHA=$(git rev-parse refs/heads/master)

        if [ "$TAG_SHA" == "$MASTER_SHA" ]; then
          echo "Tag is on the master branch. Proceeding with the workflow."
        else
          echo "Tag is not on the master branch. Cancelling the workflow."
          exit 1
        fi

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: "3.x"

    - name: Install pypa/build/setuptools/twine
      run: >-
        python3 -m
        pip install
        build setuptools twine
        --user

    - name: Prevent fallback onto setup.py
      run: rm setup.py

    - name: Build a binary wheel and a source tarball
      run: python3 -m build

    - name: Publish to TestPyPI
      env:
        TWINE_USERNAME: __token__
        TWINE_PASSWORD: ${{ secrets.TEST_PYPI_TOKEN }}
      run: twine upload --repository-url https://test.pypi.org/legacy/ dist/*