CI: Harden GHA configuration #8

	---

	name: Release
	permissions:
	contents: read
	on:
	release:
	types:
	- published

	permissions:
Check failure on line 11 in .github/workflows/release.yml View workflow run for this annotation GitHub Actions / .github/workflows/release.yml Invalid workflow file `You have an error in your yaml syntax on line 11`
	contents: read

	jobs:
	build:
	name: Build Release Packages
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	fetch-depth: 0
	persist-credentials: false

	- name: Set up Python
	id: setup
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
	with:
	python-version: '3.x'

	- name: Install build tools
	run: \|
	python -m pip install --upgrade pip
	python -m pip install --upgrade build

	- name: Build packages
	run: python -m build

	- name: Save built packages as artifact
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
	with:
	name: packages-${{ runner.os }}-${{ steps.setup.outputs.python-version }}
	path: dist/
	if-no-files-found: error
	retention-days: 5

	publish:
	name: Upload release to PyPI
	needs: build
	runs-on: ubuntu-latest
	environment: release
	permissions:
	attestations: write
	contents: read
	id-token: write
	steps:
	- name: Download packages
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
	with:
	pattern: packages-*
	path: dist
	merge-multiple: true

	- name: Publish package distributions to PyPI
	uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4

Provide feedback