publish.yml

name: Publish to PyPI

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

jobs:
  build-and-publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.13'
        
    - name: Install uv
      uses: astral-sh/setup-uv@v4
      
    - name: Install dependencies
      run: |
        uv sync
        
    - name: Build package
      run: |
        uv build
        
    - name: Debug OIDC token
      run: |
        echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN: ${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-'NOT SET'}"
        echo "ACTIONS_ID_TOKEN_REQUEST_URL: ${ACTIONS_ID_TOKEN_REQUEST_URL:-'NOT SET'}"
        
    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        packages-dir: dist/
        verbose: true
        print-hash: true