update pytest_and_autopublish.yml for GitHub Actions workflow.

PiperOrigin-RevId: 718893381

.github/workflows/pytest_and_autopublish.yml

@@ -1,7 +1,27 @@
 name: Unittests & Auto-publish
 
-# Allow to trigger the workflow manually (e.g. when deps changes)
-on: [push, workflow_dispatch]
+# Allow to trigger the workflow manually (e.g. when deps changes) or on tag pushes.
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*'  # Trigger only on tags starting from 'v'.
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      publish_to_pypi:
+        description: 'Publish to PyPI?'
+        required: false
+        type: boolean
+        default: false
+      publish_to_testpypi:
+        description: 'Publish to TestPyPI?'
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   pytest-job:
@@ -31,24 +51,84 @@ jobs:
     - name: Run core tests
       run: pytest -vv -n auto
 
-  # Auto-publish when version is increased
-  # publish-job:
-  #   # Only try to publish if:
-  #   # * Repo is self (prevents running from forks)
-  #   # * Branch is `main`
-  #   if: |
-  #     github.repository == 'google/meridian'
-  #     && github.ref == 'refs/heads/main'
-  #   needs: pytest-job  # Only publish after tests are successful
-  #   runs-on: ubuntu-latest
-  #   permissions:
-  #     contents: write
-  #   timeout-minutes: 30
-
-  #   steps:
-  #   # Publish the package (if local `__version__` > pip version)
-  #   - uses: etils-actions/pypi-auto-publish@v1
-  #     with:
-  #       pypi-token: ${{ secrets.PYPI_API_TOKEN }}
-  #       gh-token: ${{ secrets.GITHUB_TOKEN }}
-  #       parse-changelog: true
+  build:
+    name: Build distribution
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.10"
+    - name: Install pypa/build
+      run: >-
+        python3 -m
+        pip install
+        build
+        --user
+    - name: Build a binary wheel and a source tarball
+      run: python3 -m build
+    - name: Store the distribution packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+
+  publish-to-pypi:
+    name: >-
+      Publish Python distribution to PyPI
+    # Check if it's a tag push or the `publish_to_pypi` workflow is selected in a manual trigger.
+    if: >
+      (github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/'))
+      || (github.event_name == 'workflow_dispatch'
+          && github.event.inputs.publish_to_pypi == 'true')
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/google-meridian
+    permissions:
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
+
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+
+  publish-to-testpypi:
+    name: Publish Python distribution to TestPyPI
+    # Check if the `publish_to_testpypi` workflow is selected in a manual trigger.
+    if: >
+      (github.event_name == 'workflow_dispatch'
+        && github.event.inputs.publish_to_testpypi == 'true')
+    needs:
+    - build
+    runs-on: ubuntu-latest
+
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/meridian
+
+    permissions:
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
+
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution to TestPyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        repository-url: https://test.pypi.org/legacy/
+        verbose: true