Version 4.0.0 #7

	name: Publish to PyPI on Release

	on:
	release:
	types: [published]

	permissions:
	contents: read

	jobs:
	publish:
	if: github.event.release.prerelease == false
	runs-on: ubuntu-latest
	environment:
	name: pypi
	url: https://pypi.org/project/gdxpds/
	permissions:
	id-token: write # required for PyPI Trusted Publishing (OIDC)
	steps:
	- uses: actions/checkout@v4
	with:
	ref: ${{ github.event.release.tag_name }}

	- uses: actions/setup-python@v5
	with:
	python-version: '3.13'
	cache: 'pip'
	cache-dependency-path: pyproject.toml

	- name: Build sdist and wheel
	run: \|
	python -m pip install --upgrade pip build
	python -m build

	- name: Sanity-check release tag matches gdxpds.__version__
	shell: bash
	run: \|
	set -euo pipefail
	pkg_ver=$(python <<'PY'
	import re, pathlib
	text = pathlib.Path('src/gdxpds/__init__.py').read_text()
	m = re.search(r'^__version__\s=\s["\']([^"\']+)', text, re.MULTILINE)
	print(m.group(1))
	PY
	)
	tag="${{ github.event.release.tag_name }}"
	# Convention: release tags are vX.Y.Z. release-docs.yml deploys to
	# gh-pages/$tag, and docs.yml's cleanup pattern keeps only v[0-9]*,
	# so a tag without the 'v' would be silently wiped on the next push.
	if [[ ! "$tag" =~ ^v ]]; then
	echo "::error::Release tag '$tag' must start with 'v' (convention: vX.Y.Z)."
	exit 1
	fi
	tag_ver="${tag#v}"
	if [[ "$pkg_ver" != "$tag_ver" ]]; then
	echo "::error::Tag $tag implies version $tag_ver but src/gdxpds/__init__.py has $pkg_ver."
	exit 1
	fi

	- name: Publish via PyPI Trusted Publishing
	uses: pypa/gh-action-pypi-publish@release/v1

Provide feedback