From 4881f32342dd4ee2f3272ba498ad623ecffc462b Mon Sep 17 00:00:00 2001 From: Sahil Bali Date: Fri, 4 Sep 2026 23:20:22 +0530 Subject: [PATCH] Add tag-triggered PyPI publish workflow via Trusted Publishing Publishes on push of a v* tag, using OIDC trusted publishing (no long-lived PyPI token secret needed). Verifies the tag version matches pyproject.toml before building/publishing, so a version bump is required before every release. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/publish.yml | 38 +++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/publish.yml diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..30b75e0 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,38 @@ +name: Publish to PyPI + +on: + push: + tags: ["v*"] + +jobs: + publish: + runs-on: ubuntu-latest + environment: pypi + permissions: + id-token: write # required for PyPI Trusted Publishing (OIDC), no token secret needed + + steps: + - uses: actions/checkout@v4 + + - name: Install uv + uses: astral-sh/setup-uv@v3 + with: + version: "latest" + + - name: Set up Python + run: uv python install 3.12 + + - name: Verify tag matches pyproject.toml version + run: | + TAG_VERSION="${GITHUB_REF_NAME#v}" + PYPROJECT_VERSION=$(grep -m1 '^version = ' pyproject.toml | sed -E 's/version = "(.*)"/\1/') + if [ "$TAG_VERSION" != "$PYPROJECT_VERSION" ]; then + echo "Tag v$TAG_VERSION does not match pyproject.toml version $PYPROJECT_VERSION" + exit 1 + fi + + - name: Build + run: uv build + + - name: Publish to PyPI + run: uv publish