publish_artifacts.yaml

name: Publish release artifacts
on:
  release:
    types: [released, prereleased]
jobs:
  build-and-publish-pypi:
    if: github.repository_owner == 'galaxyproject'
    name: Build and Publish to PyPI
    runs-on: ubuntu-latest
    strategy:
        matrix:
            python-version: ['3.9']
    steps:
      - uses: actions/checkout@v5
        with:
          persist-credentials: false
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install script dependencies
        run: pip install galaxy-release-util
      - name: Build and publish to PyPI
        run: |
          galaxy-release-util build-and-upload --no-confirm
        env:
            TWINE_USERNAME: __token__
            TWINE_PASSWORD: ${{ github.event.release.prerelease && secrets.PYPI_TEST_TOKEN || secrets.PYPI_MAIN_TOKEN }}
            TWINE_REPOSITORY_URL: ${{ github.event.release.prerelease && 'https://test.pypi.org/legacy/' || 'https://upload.pypi.org/legacy/' }}

  build-and-publish-npm:
    if: github.repository_owner == 'galaxyproject'
    name: Build and Publish to NPM
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - uses: actions/checkout@v5
      - name: Read Node.js version
        id: node-version
        run: echo "version=$(cat client/.node_version)" >> $GITHUB_OUTPUT
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ steps.node-version.outputs.version }}
          cache: 'yarn'
          cache-dependency-path: 'client/yarn.lock'
          registry-url: 'https://registry.npmjs.org'
      - name: build client
        run: yarn && yarn build-production
        working-directory: 'client'
      - name: publish client
        if: "!github.event.release.prerelease"
        run: npm publish --provenance --access public
        working-directory: 'client'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}