Update publish.yml

Author: 1minds3t

.github/workflows/publish.yml

@@ -1,40 +1,56 @@
 # .github/workflows/publish-to-pypi.yml
 
-name: Publish Python Package to PyPI
+name: Publish to PyPI
 
 on:
   release:
-    types: [published] # This workflow runs when a new release is published on GitHub
+    types: [published]
+  workflow_dispatch: # Allows you to manually trigger the workflow
+
+permissions:
+  contents: read
+  id-token: write # Required for secure OIDC authentication with PyPI
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
-
+    environment: pypi # Recommended for security
+    
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
+      # This fetches the specific commit associated with the tag
+      # to ensure the workflow is using the correct code.
 
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
-        # Use the specific Python version you require, e-g-, 3.11
         python-version: '3.11'
+        cache: 'pip' # Speeds up dependency installation
 
-    - name: Install modern build dependencies
+    - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
         pip install build twine
-        # build - The modern, PEP 517 compliant build frontend
-        # twine - The standard for securely uploading packages
 
-    - name: Build package
-      # This command automatically finds and uses your pyproject.toml
-      # It builds the source distribution (sdist) and the wheel.
-      run: python -m build
+    - name: Verify package version
+      run: |
+        PACKAGE_VERSION=$(python -c "import toml; print(toml.load(open('pyproject.toml'))['project']['version'])")
+        echo "Detected version from pyproject.toml: $PACKAGE_VERSION"
+        echo "Expected tag version: ${{ github.ref_name }}"
+        if [ "$PACKAGE_VERSION" != "${{ github.ref_name }}" ]; then
+          echo "Error: The version in pyproject.toml does not match the release tag."
+          exit 1
+        fi
+
+    - name: Clean old builds and build new package
+      run: |
+        rm -rf dist/ # Always delete the old dist directory to prevent stale artifacts
+        python -m build
 
     - name: Publish package to PyPI
-      env:
-        # Use the secret you created in GitHub Settings -> Secrets -> Actions
-        TWINE_USERNAME: __token__
-        TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
-      run: twine upload dist/*
+      uses: pypa/gh-action-pypi-publish@release/v1 # This action is a secure and recommended way to publish
+      with:
+        password: ${{ secrets.PYPI_API_TOKEN }}
+        # The action will automatically find and upload the files in the 'dist' folder
+