_reusable-package-testpypi.yml

---
name: Publish to TestPyPI
on:
  workflow_call:
    inputs:
      package-name:
        description: The name of the package to build, upload, and install.
        required: true
        type: string
      repo-name:
        description: The full name of the repository to use to gate uploads, in the
          format `owner/repo`.
        required: true
        type: string
    secrets:
      test-pypi-api-token:
        description: The API token for the package on test.pypi.org.
        required: true
concurrency:
  group: pypi (Reusable Workflows)
env:
  PACKAGE_NAME: ${{ inputs.package-name }}
jobs:
  test-pypi-build:
    name: Build package with unique version for test.pypi.org
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - uses: tektronix/python-package-ci-cd/actions/create_unique_testpypi_version@v1.6.1
        id: create-version
        with:
          package-name: ${{ inputs.package-name }}
      - name: Build package
        uses: hynek/build-and-inspect-python-package@14c7e53f5d033cfa99f7af916fa59a6f7f356394 # v2.11.0
        with:
          attest-build-provenance-github: 'true'
    outputs:
      built-version: ${{ steps.create-version.outputs.new-version }}
  test-pypi-upload:
    name: Upload package to test.pypi.org
    needs: [test-pypi-build]
    if: github.repository == inputs.repo-name
    runs-on: ubuntu-latest
    environment: package-testpypi
    permissions:
      id-token: write
    steps:
      - name: Download built packages
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
        with:
          name: Packages
          path: dist
      - name: Upload package to Test PyPI
        uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0  # v1.9.0
        with:
          password: ${{ secrets.test-pypi-api-token }}
          repository-url: https://test.pypi.org/legacy/
  test-pypi-install:
    name: Install package from test.pypi.org
    needs: [test-pypi-build, test-pypi-upload]
    if: github.repository == inputs.repo-name
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version-file: pyproject.toml
      - name: Test installing from test.pypi.org
        # A retry is used to allow for some downtime before the package is installable
        uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e  # v3.0.0
        with:
          timeout_minutes: 10
          max_attempts: 5
          retry_wait_seconds: 30
          warning_on_retry: false
          command: pip install --index-url=https://test.pypi.org/simple/ --extra-index-url=https://pypi.org/simple
            "$PACKAGE_NAME==${{ needs.test-pypi-build.outputs.built-version }}"