name: Project release on PyPi

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+*"
      # We must not release versions tagged with -rc0 suffix
      - "!v[0-9]+.[0-9]+.[0-9]-rc0"

env:
  HATCH_VERSION: "1.16.5"

permissions:
  contents: read

jobs:
  release-on-pypi:
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Hatch
        run: |
          python -m pip install --upgrade pip
          pip install hatch==${{ env.HATCH_VERSION }} --uploaded-prior-to=P1D

      - name: Build Haystack
        run: hatch build

      - name: Publish on PyPi
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0