Updates to README.md and github/workflow supply-chain concern #14

	name: Build and Publish to PyPI

	on:
	push:
	tags:
	- "v*"
	release:
	types: [published]

	permissions:
	contents: read
	id-token: write # Required for OIDC
	actions: read

	jobs:
	build:
	name: Build sdist and wheel
	runs-on: ubuntu-latest

	steps:
	- name: Check out source
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
	with:
	fetch-depth: 0 # Important for setuptools_scm

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.10"

	- name: Install build tool
	run: \|
	python -m pip install --upgrade pip
	pip install build setuptools_scm

	- name: Build package
	run: python -m build --sdist --wheel --outdir dist

	- name: Upload build artifacts
	uses: actions/upload-artifact@v4
	with:
	name: dist
	path: dist/

	publish:
	name: Publish to PyPI (OIDC)
	needs: build
	runs-on: ubuntu-latest
	environment: pypi


	permissions:
	id-token: write # Required for trusted publishing
	contents: read

	steps:
	- name: Download build artifacts
	uses: actions/download-artifact@v4
	with:
	name: dist
	path: dist/

	- name: Publish to PyPI via OIDC
	uses: pypa/gh-action-pypi-publish@release/v1
	with:
	verbose: true
	skip-existing: false

Navigation Menu