{#- OZI 0.1
# ozi/templates/github_workflows/release.yml
# Part of the OZI Project, under the Apache License v2.0 with LLVM Exceptions.
# See LICENSE.txt for license information.
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
#}
  release:
    needs: checkpoint
    runs-on: ubuntu-latest
    concurrency: release
    strategy:
      matrix:
        py:
          - {{ spec.python.support.security|wheel_repr }}
          - {{ spec.python.support.bugfix2|wheel_repr }}
          - {{ spec.python.support.bugfix1|wheel_repr }}
      fail-fast: true
      max-parallel: 1
    outputs:
{%- raw %}
      drafted: ${{ steps.draft.outputs.created }}
      hashes: ${{ steps.release.outputs.hashes }}
      tag: ${{ steps.release.outputs.tag }}
{%- endraw %}
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            fulcio.sigstore.dev:443
            github.com:443
            pypi.org:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443

      - uses: OZI-Project/release@0e6bbf31af68d4e104aa7b27a35b8f8118924985
        id: release
        with:
{%- raw %}
          python-dist: ${{ matrix.py }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
{%- endraw %}
