Add PyPI publishing workflow with GitHub deployments integration

Author: neverinfamous

.github/workflows/publish-pypi.yml

@@ -0,0 +1,71 @@
+---
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to publish (must match pyproject.toml)"
+        required: true
+        default: ""
+
+# Security: Explicit permissions following principle of least privilege
+permissions:
+  contents: read
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/sqlite-mcp-server-enhanced/
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install build dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install build twine hatchling
+
+      - name: Verify version matches
+        if: github.event_name == 'release'
+        run: |
+          PYPROJECT_VERSION=$(grep -Po '(?<=^version = ")[^"]*' pyproject.toml)
+          RELEASE_VERSION="${GITHUB_REF#refs/tags/v}"
+          echo "PyProject version: $PYPROJECT_VERSION"
+          echo "Release version: $RELEASE_VERSION"
+          if [ "$PYPROJECT_VERSION" != "$RELEASE_VERSION" ]; then
+            echo "Error: Version mismatch!"
+            exit 1
+          fi
+
+      - name: Build package
+        run: python -m build
+
+      - name: Check distribution
+        run: twine check dist/*
+
+      - name: List built artifacts
+        run: ls -lh dist/
+
+      - name: Publish to PyPI
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        run: twine upload dist/*
+
+      - name: Verify publication
+        run: |
+          sleep 10  # Wait for PyPI to update
+          pip index versions sqlite-mcp-server-enhanced
+
+