publish.yml

# .github/workflows/publish.yml

name: Publish Python 🐍 distributions to PyPI

on:
  # This workflow is triggered manually from the GitHub Actions UI
  workflow_dispatch:

concurrency:
  group: publish
  cancel-in-progress: false

jobs:
  build-and-publish:
    name: Build and publish to PyPI
    runs-on: ubuntu-latest
    environment: pypi-publish

    # These permissions are essential for trusted publishing
    permissions:
      id-token: write  # This is required for passwordless deployment

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      # It's a good practice to fetch all history for a more accurate version number
      with:
        fetch-depth: 0

    - name: Install uv and set the Python version
      uses: astral-sh/setup-uv@v6
      with:
        # Install a specific version of uv.
        version: 0.9.7
        python-version: "3.9"
        enable-cache: true

    - name: Install dependencies and project
      run: uv sync --locked --all-extras --dev

    - name: Install build dependencies
      run: uv pip install build setuptools wheel

    - name: Build package
      run: uv run python -m build

    - name: Verify build module installation
      run: uv pip show build

    - name: Upload built distributions
      uses: actions/upload-artifact@v4
      with:
        name: dist-files
        path: dist/*

    # - name: Publish package to PyPI
    #   uses: pypa/gh-action-pypi-publish@release/v1
      # The `id-token: write` permission allows this action to get a temporary
      # token from GitHub's OIDC provider, which PyPI trusts. No API token needed here.
    - name: Publish package to TestPyPI
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        repository-url: https://test.pypi.org/legacy/