publish.yml

name: Publish to PyPI via Trusted Publisher

on:
  push:
    tags:
    - v*

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: pypi   # environment name must match what you configure on PyPI
    permissions:
      id-token: write   # required for OIDC trusted publishing
      contents: read    # minimal other permissions (you may trim more if possible)

    steps:
    - uses: actions/checkout@v5

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: 3.x

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        python -m pip install build

    - name: Build package
      run: python -m build

    - name: Publish distribution to PyPI
      if: startsWith(github.ref, 'refs/tags/')
      uses: pypa/gh-action-pypi-publish@release/v1.13
      with:
        skip-existing: true
        verbose: true