Merge pull request #853 from maresb/ty #432

	name: publish

	# Disable default permissions and grant minimal required permissions
	permissions: {}

	on:
	release:
	types:
	- published
	push:
	branches: [master, main]

	jobs:
	build:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	actions: write # for uploading artifacts
	steps:
	- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
	with:
	fetch-depth: 0
	persist-credentials: false

	- name: Set up Python
	uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
	with:
	python-version: "3.10"

	- name: build
	run: \|
	python -m pip install wheel twine build
	python -m build

	- name: Check files
	run: \|
	ls dist
	shell: bash

	- name: Test wheels
	run: \|
	python -m twine check --strict dist/*
	shell: bash

	- name: Upload dist files for publication
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
	with:
	name: dist-files
	path: dist

	publish:
	name: Publish Python 🐍 distributions 📦 to PyPI
	runs-on: ubuntu-latest
	if: ${{ github.event_name == 'release' }}
	needs: build
	# Run this job in an isolated GHA environment containing the OIDC credentials.
	environment: release
	permissions:
	id-token: write # for trusted publishing to PyPI
	actions: read # for downloading artifacts
	steps:
	- uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
	with:
	name: dist-files
	path: dist
	- name: Publish a Python distribution to PyPI
	uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

Provide feedback