python-publish.yml

# Build and publish the package to PyPI when a GitHub release is published.
# Uses PyPI Trusted Publishing (OIDC) — no API token/secret required.
# See: https://docs.astral.sh/uv/guides/integration/github/#publishing
#      https://docs.pypi.org/trusted-publishers/

name: Upload Python Package

on:
  release:
    types: [published]

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      # Required for Trusted Publishing: lets the job mint a short-lived OIDC
      # token that PyPI exchanges for an upload token. No stored secret.
      id-token: write
      contents: read

    steps:
    - uses: actions/checkout@v5
    - name: Install uv
      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
    - name: Build package
      run: uv build
    - name: Publish package
      # uv auto-detects the GitHub Actions OIDC credentials (trusted publishing).
      run: uv publish