release.yml

name: publish

# Publish to PyPI via OIDC Trusted Publishing (no API token) with PEP 740 attestations.
# Runs when a GitHub Release is published. Requires a matching Trusted Publisher on PyPI.
# Guards: the release tag must equal the project version, and twine must pass, before publish.
on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  pypi-publish:
    name: Build and publish
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # OIDC token for Trusted Publishing + signed attestations
      contents: read
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - name: Install pinned build toolchain
        run: python -m pip install "build~=1.2" "twine~=6.1"
      - name: Verify release tag matches project version
        run: |
          version=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
          tag="${GITHUB_REF_NAME#v}"
          echo "project version: $version | release tag: $tag"
          if [ "$version" != "$tag" ]; then
            echo "::error::release tag '$tag' does not match project version '$version'"
            exit 1
          fi
      - name: Build sdist and wheel
        run: python -m build
      - name: Check distributions
        run: python -m twine check dist/*
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2