release.yml

# Build sdist/wheel and publish to PyPI when a version tag is pushed (e.g. v1.7.0).
#
# Auth (pick one):
#
# 1) Trusted publishing (no secrets): PyPI → your project → Publishing →
#    "Add a pending publisher" → GitHub → Owner `DavidTbilisi` → Repository
#    `FileTagger` → Workflow `release.yml` → Environment name **leave blank**
#    unless you also create a GitHub Environment with the same name on both sides.
#    This workflow does **not** set `jobs.publish.environment`, so OIDC sends
#    `environment: MISSING` — PyPI must match that (blank environment field).
#
# 2) API token: create a PyPI project-scoped token, add repo secret `PYPI_API_TOKEN`.
#    When the secret is set, `gh-action-pypi-publish` uses it; when empty, it
#    falls back to OIDC (see pypa/gh-action-pypi-publish PR #122).

name: release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install build
        run: pip install --upgrade pip build

      - name: Build sdist and wheel
        run: python -m build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}