feat: add separate 'publish-enabled' to enable publishing package

README.md

@@ -409,10 +409,29 @@ The release job is bound to the `publish` stage, appears only on production and
 | :lock: `GIT_PASSWORD`   | Git password for Git push operations (see below)                        | _none_            |
 | :lock: `GIT_PRIVATE_KEY`| SSH key for Git push operations (see below)                             | _none_            |
 | `release-commit-message` / `PYTHON_RELEASE_COMMIT_MESSAGE`| The Git commit message to use on the release commit. This is templated using the [Python Format String Syntax](http://docs.python.org/2/library/string.html#format-string-syntax). Available in the template context are current_version and new_version. | `chore(python-release): {current_version} → {new_version}` |
+
+When `py-release` job is enabled, `py-publish` job is automatically enabled too.
+
+### `py-publish` job
+
+This job is **disabled by default** and allow to publish the built packages to a PyPI compatible repository ([GitLab packages](https://docs.gitlab.com/ee/user/packages/pypi_repository/) by default.
+
+The Python template supports three packaging systems:
+
+* [Poetry](https://python-poetry.org/): uses Poetry-specific [version](https://python-poetry.org/docs/cli/#version), [build](https://python-poetry.org/docs/cli/#build) and [publish](https://python-poetry.org/docs/cli/#publish) commands.
+* [uv](https://docs.astral.sh/uv/): uses [uv](https://docs.astral.sh/uv/) as version management, [build](https://docs.astral.sh/uv/guides/publish/#building-your-package) as package builder and [publish](https://docs.astral.sh/uv/guides/publish/) to publish.
+* [Setuptools](https://setuptools.pypa.io/): uses [bump-my-version](https://github.com/callowayproject/bump-my-version) as version management, [build](https://pypa-build.readthedocs.io/) as package builder and [Twine](https://twine.readthedocs.io/) to publish.
+
+The publish job is bound to the `publish` stage, is executed on a Git tag matching [semantic versioning pattern](https://semver.org/) and uses the following variables:
+
+| Input / Variable        | Description                                                             | Default value     |
+| ----------------------- | ----------------------------------------------------------------------- | ----------------- |
+| `publish-enabled` / `PYTHON_PUBLISH_ENABLED`| Set to `true` to enable the publish job                                 | _none_ (disabled) |
 | `repository-url` / `PYTHON_REPOSITORY_URL`| Target PyPI repository to publish packages                              | _[GitLab project's PyPI packages repository](https://docs.gitlab.com/ee/user/packages/pypi_repository/)_ |
 | `PYTHON_REPOSITORY_USERNAME`| Target PyPI repository username credential                              | `gitlab-ci-token` |
 | :lock: `PYTHON_REPOSITORY_PASSWORD`| Target PyPI repository password credential                              | `$CI_JOB_TOKEN` |
 
+
 #### Setuptools tip
 
 If you're using a  Setuptools configuration, then you will have to write a `.bumpversion.toml` or `pyproject.toml` file.

kicker.json

@@ -60,6 +60,12 @@
       "description":"This job allows building your Python project [distribution packages](https://packaging.python.org/en/latest/glossary/#term-Distribution-Package).",
       "enable_with": "PYTHON_PACKAGE_ENABLED"
     },
+    {
+      "id":"publish",
+      "name":"publish",
+      "description":"This job allows publishing the built packages to a PyPI compatible repository ([GitLab packages](https://docs.gitlab.com/ee/user/packages/pypi_repository/) by default.",
+      "enable_with": "PYTHON_PUBLISH_ENABLED"
+    },    
     {
       "id": "pylint",
       "name": "pylint",

templates/gitlab-ci-python.yml

@@ -130,6 +130,10 @@ spec:
       description: Enable Release
       type: boolean
       default: false
+    publish-enabled:
+      description: Enable Publish Package
+      type: boolean
+      default: false    
     release-next:
       description: 'The part of the version to increase (one of: `major`, `minor`, `patch`)'
       options:
@@ -287,6 +291,7 @@ variables:
   BANDIT_ENABLED: $[[ inputs.bandit-enabled ]]
   PYTHON_SBOM_DISABLED: $[[ inputs.sbom-disabled ]]
   PYTHON_RELEASE_ENABLED: $[[ inputs.release-enabled ]]
+  PYTHON_PUBLISH_ENABLED: $[[ inputs.publish-enabled ]]
 
   PYTHON_BLACK_ENABLED: $[[ inputs.black-enabled ]]
   PYTHON_ISORT_ENABLED: $[[ inputs.isort-enabled ]]
@@ -1402,7 +1407,7 @@ py-publish:
       - $PYTHON_PROJECT_DIR/dist/*
   rules:
     # exclude if $PYTHON_RELEASE_ENABLED not set
-    - if: '$PYTHON_RELEASE_ENABLED != "true"'
+    - if: '$PYTHON_RELEASE_ENABLED != "true" && $PYTHON_PUBLISH_ENABLED != "true"'
       when: never
     # on tag with release pattern: auto
     - if: '$CI_COMMIT_TAG =~ $RELEASE_REF'