pythonpublish.yml

name: Upload Python Package

on:
  release:
    types: [published]

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: "3.x"

      - name: Install build tools
        run: |
          python -m pip install --upgrade pip
          python -m pip install build

      - name: Build distributions
        run: |
          python -m build

      - name: Upload dist artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dist
          path: dist/*

  publish:
    needs: build
    runs-on: ubuntu-latest

    # If you configured a GitHub Environment name in PyPI Trusted Publisher,
    # set the same environment name here (recommended).
    environment: pypi

    permissions:
      contents: read
      id-token: write  # REQUIRED for OIDC / Trusted Publishing

    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: dist
          path: dist

      - name: Publish to PyPI (OIDC Trusted Publishing)
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0